Requiring and enforcing known-key gpg commit signatures

[Andreas K. Huettel]

Hi all, 

we've made good experiences in Gentoo with requiring and enforcing (on push)
known-key gpg commit signatures. [1,2]

How about introducing this for glibc too?

The signatures would improve verifiability of the repository [3] and
the ability to trace back events in case of a (gasp) compromise.

Cheers,
Andreas


[1] Let's not discuss the technical details yet. Gentoo runs gitolite and
it works just fine there.

[2] We also have a key policy etc bla to go with that.

[3] Not perfectly, since only (to my knowledge) the git SHA1 hash is 
signed by gpg. However, it's a first step.


-- 
PD Dr. Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer 
(council, comrel, toolchain, base-system, perl, libreoffice)
https://wiki.gentoo.org/wiki/User:Dilfridge
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 870 bytes
Desc: This is a digitally signed message part.
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260930/af91bb9f/attachment.sig>