Re: Next steps from GTI TAC meeting on 2023-03-08 - Evaluate cost of glibc migration.

On 2023-05-24 14:55, Brian Behlendorf wrote:
>> Signed commits would be nice, but we're not there yet as a community.
> 
> It's not quite as easy as "hey just add -s to your git commands" but 
> it's not far from that. I'm not a part of the TAC so I won't go further 
> than to suggest that a migration, where there will no doubt have to be 
> some adjustments to process and flow, to introduce other non-zero-effort 
> but non-blocking changes that enhance overall security/integrity.

The challenge with cryptographic signing of commits is not a technical 
one, there are folks who oppose it on an ideological basis.  It's 
probably not that hard to drive consensus in the glibc community for 
this, but that's still going to be an additional hurdle to cross.  I'm 
not sure if the initial migration is the right time to tackle this.

Likewise for a process change that requires a single trusted gatekeeper. 
  Even if it has technical merit (I'm still not a 100% convinced), it's 
going to be harder to bring in a non-trivial process change like that 
during the initial migration.

Thanks,
Sid