Code isn't signed in any way about python-trezor HOT 8 CLOSED

couldn't the same complaint be made about github.com/bitcoin/bitcoin or for that matter practically anything on github?

some commits on bitcoin repo are signed, but by no means all. Is there a policy for sign offs in bitcoin repo, or just ad hoc?

Is there anything about python-trezor that makes signatures here even more important than, say, bitcoin repo?

from python-trezor.

The Bitcoin Core maintainers ensure all commits that end up directly in git HEAD are signed (typically merge commits). Theres even a git push hook script to ensure this in the repo under control/ It'd be better if all contributors also signed commits, but ensuring git HEAD is signed is an important first step. Also of course, git tags are always signed.

That other projects don't bother isn't an excuse...

from python-trezor.

bitcoin git:(master) $ git log --show-signature | grep commit -A1 | head -n30 | grep commit | wc -l
10
bitcoin git:(master) $ git log --show-signature | grep commit -A1 | head -n30 | grep gpg | wc -l
7

so only 7 out of 10 last commits signed in master, unless am I missing something?

(update)

"all commits that end up directly in git HEAD"

did you mean git master?

Can you point to the hook script? Perhaps this coud be reused by python-trezor, or others, as best practice?

I'm thinking of cloning this issue for some repos under haskoin, but I want to make sure I understand action to take first.

it looks like the last two tags since v0.9.0rc1 have sigs, that's good.

from python-trezor.

What is the point of signing commits if you haven't verified the fingerprint of my GPG key via phone or meeting me in person?

from python-trezor.

I suppose if the main devs in btc world don't already have a web of trust relationship, maybe this is something that SHOULD be remedied by a phone call. I haven't invested into WOT myself, but it does seem like a healthy thing to do.

a skype video call, with a picture of the keyholder from a trusted source, is a little more spoof proof maybe...

from python-trezor.

@tphyahoo You are missing something: notice how all the merge commits are signed? (mostly by wladimir)

@prusnak For starters, if I ever get a copy of the code that is validly signed by you, even just once, I can use it to verify that i have code from the same person in the future by checking that the key hasn't changed from my old copy. This is also a matter of general post-hack audit capabilities: if github gets hacked we might not notice immediately, but we'd sure like to be able to figure out where the hack happened after the fact.

from python-trezor.

OK, I configured git so now it signs my commits. Let's close this now.

from python-trezor.

Thanks! You're signatures look good here!

from python-trezor.