Date: Sun, 18 Nov 2012 00:59:54 -0500 From: grarpamp <grarpamp@gmail.com> To: freebsd-questions@freebsd.org Cc: freebsd-hackers@freebsd.org, freebsd-hubs@freebsd.org, freebsd-security@freebsd.org Subject: Re: FreeBSD needs Git to ensure repo integrity [was: 2012 incident] Message-ID: <CAD2Ti28Ha323x4=5OPafh2UCsmQDqn-5ZN4mNs=CwRSVpAkLgQ@mail.gmail.com> In-Reply-To: <CAJ-VmonryjAOW-Ty%2Bs3wj6BfWiQzxSL-waEYnQ5wLv4eFjQ_4Q@mail.gmail.com> References: <CAD2Ti29UoFcHendR8CcdQ4FPNW1HH0O47B1i3JW00Lke2m2POg@mail.gmail.com> <CAJ-VmonryjAOW-Ty%2Bs3wj6BfWiQzxSL-waEYnQ5wLv4eFjQ_4Q@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
>> joerg_wunsch@uriah.heep.sax.de > You don't even have a name Your domain indicates Germany, please have a chat with CCC.de about the various good uses for nyms. And consult your library for some fine historical use cases. If that's counter to your beliefs, you are free to show us the way and post all your personal infos to the list. > spamming a large number of FreeBSD mailinglists with your advocacy? This topic would benefit from the review and involvement of users (questions), committers (hackers), security (security), and distribution (hubs). > -- > Never trust an operating system you don't have sources for. ;-) As well summarized by this (your signature) ... sources you can't verify to the master are, also, sources you can't trust. >> fidaj@ukr.net > LOL And how will this help Linux? > http://lwn.net/Articles/457142/ How will what help Linux? Please quote a relevant snippet instead of the entire message. Seems pretty clear from the above link that having hashes/crypto as an intrinsic feature of the SCM tool does in fact help Linux. If you're asking about distribution of things traceable back to the master repo, at least your security officer can sign the initial repository commit and then include the various distribution keys and subsequent updates, signed tags, etc in the repo. >> utisoft@gmail.com > Yes, but git doesn't work with our workflow. There's usually a larger than head sized sandbox near everyone's local neighborhood. Will people elect to visit it, or to learn, grow, and change for the better? Prioe workflow is often forced by and derived from the tools being used. Different tools could enable different, more useful workflows. SVN required workflow change from CVS, people managed just fine. > It's been discussed several times I will look for these. Can you point to a couple main threads? > [git] ... is GPL btw FreeBSD does not include this sort-of-BSD licensed SCM tool in its base either... # https://svn.apache.org/repos/asf/subversion/trunk/LICENSE # ls /*bin/svn /usr/*bin/svn ls: No such file or directory But it does include this GPL licensed one... # http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/COPYING?revision=HEAD # ls /*bin/cvs /usr/*bin/cvs' /usr/bin/cvs And of course we have this in use as well... # perforce http://www.perforce.com/purchase/pricing-licensing So it seems license is not an obstacle to inclusion, and certainly not the use via ports, of any particular SCM with the FreeBSD project. >> rsimmons0@gmail.com > https://github.com/freebsd/ >> adrian@freebsd.org > You can look at what goes into the FreeBSD Git clone to get your > assurance that things aren't being snuck in. The same could be said for the CVS clone. Again... Any copy of something that is itself not verifiable provides no such assurance. > Those who want to use git can use it, right now. Honest. Yes, Git does seem to me to be leading the other distributed, hash based, SCM tools such as Hg. Thus Git is suggested. Yes, Git would fill the purpose. I only suggest Git, as to some other choices that use hashes (as usual, please verify with current releases)... https://en.wikipedia.org/wiki/Comparison_of_revision_control_software But this is not really about using Git in particular... These replies are all dodging around the base issue raised... - That FreeBSD has no verifiable source repo - Which is not only a problem for the repo itself, but for everything attempted to be spawned downstream off of that root (no verifiable distribution system/tools distributing that repo, etc). Sorry to reply to these sorts of replies this way, but please, this isn't a troll or a shed. No need to do that around the issue raised. Hash [ :-) ] it out and solve it. Why wait for a costlier breach? Why not provide the assurance beforehand? No better time than now. >> gmx@ross.cx > http://www.linux.com/news/featured-blogs/171-jonathan-corbet/491001-the-cracking-of-kernelorg Yes, another good link outlining the issue.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAD2Ti28Ha323x4=5OPafh2UCsmQDqn-5ZN4mNs=CwRSVpAkLgQ>