Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Gitlab.com as the primary git entry point for Sourcemage

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael.luceno AT gmail.com>
  • To: Thomas Orgis <thomas-forum AT orgis.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Gitlab.com as the primary git entry point for Sourcemage
  • Date: Tue, 29 Sep 2015 13:50:04 -0300

On Sat, 12 Sep 2015 10:29:19 +0200
Thomas Orgis <thomas-forum AT orgis.org> wrote:
> Am Fri, 11 Sep 2015 12:56:23 -0700
> schrieb Eric Sandall <eric AT sandall.us>:
>
> > Git itself protects us
> > from out-of-process modifications.
>
> Could you elaborate on that? For sure, someone with root access to the
> hosting machine can fake any commit desired by manipulating the
> repository on disk? Only the commit data itself is protected against
> modification by a hash sum.

It doesn't protect us, at least not by default. Using detached
signatures might do the trick, but we need a review process coupled
with a verification system, and the signatures might amount to a
significant overhead...

<...>
> Perhaps we do need to put a process in place where at least
> two people need to agree on a commit before it goes into the stable
> (-rc) branch? Hosting our distro stuff besides git (in case we don't
> just go for the "Why release? Just let people download a tag from
> git." thing that's getting popular) means that we need some kind of
> actual quality control before things are put into tarballs and ISOs.
> This would mean to actually look at the changes, not just check if
> things still build.

+1.




Archive powered by MHonArc 2.6.24.

Top of Page