From kde-scm-interest  Sat Nov 14 22:55:30 2009
From: argonel <argonel () gmail ! com>
Date: Sat, 14 Nov 2009 22:55:30 +0000
To: kde-scm-interest
Subject: Re: [Kde-scm-interest] accountability
Message-Id: <28d9390d0911141455s69cd094fx8204632aa4a8a91f () mail ! gmail ! com>
X-MARC-Message: https://marc.info/?l=kde-scm-interest&m=125823937000580
MIME-Version: 1
Content-Type: multipart/mixed; boundary="--===============0660210129=="

--===============0660210129==
Content-Type: multipart/alternative; boundary=0016e6d9a2c75677b004785cac0f

--0016e6d9a2c75677b004785cac0f
Content-Type: text/plain; charset=ISO-8859-1

2009/11/14 Chani <chanika@gmail.com>

> On November 13, 2009 08:06:49 Jeff Mitchell wrote:
> > Ian Monroe wrote:
> > > Which is why I like my simple flat-file log idea (a log of commit
> > > hash, user id, maybe time). It doesn't open up any privacy issues
> > > (since the info is already public) and would solve the problem by
> > > using the commit hash, which is a nice security feature of git.
> >
> > You still have an issue in that the user id is internal to Gitorious and
> > is meaningless without also providing further information, like email
> > address, name, public ssh key, or some such thing.
> >
> > All of those could be seen as potential privacy issues; for instance,
> > you might think the email address would be obvious, but what if a person
> > is committing under a different email address than what they've given to
> > Gitorious?
> >
> > --Jeff
> >
>
> I still don't understand why we need access to email addresses from some
> gitorious database anyways. if you want to push to a kde repo, you have to
> be
> in the kde-developers group. we can require people to agree to whatever's
> needed at the time they join that group. all we need is a log of which kde
> developer pushed what, right?
> everything else you can get from a git clone...
>
>
The problem is that your email address according to Git and your
kde-developers group membership are not necessarily related, so there is no
guaranteed way to map the commit back to the person that commited.

My suggestion is to have a pre-commit hook that compares the email address
on the commit message to the list of subscribers to kde-cvs-announce (or
bugzilla) and if it isn't found, reject the commit. We'll need a mechanism
for syncing this list, but it should not be an unsurmountable hurdle.


> --
> This message brought to you by eevil bananas and the number 3.
> www.chani3.com
>
> _______________________________________________
> Kde-scm-interest mailing list
> Kde-scm-interest@kde.org
> https://mail.kde.org/mailman/listinfo/kde-scm-interest
>
>

--0016e6d9a2c75677b004785cac0f
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<br><br><div class=3D"gmail_quote">2009/11/14 Chani <span dir=3D"ltr">&lt;<=
a href=3D"mailto:chanika@gmail.com">chanika@gmail.com</a>&gt;</span><br><bl=
ockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, 204=
, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class=3D"h5">On November 13, 2009 08:06:49 Jeff Mitche=
ll wrote:<br>
&gt; Ian Monroe wrote:<br>
&gt; &gt; Which is why I like my simple flat-file log idea (a log of commit=
<br>
&gt; &gt; hash, user id, maybe time). It doesn&#39;t open up any privacy is=
sues<br>
&gt; &gt; (since the info is already public) and would solve the problem by=
<br>
&gt; &gt; using the commit hash, which is a nice security feature of git.<b=
r>
&gt;<br>
&gt; You still have an issue in that the user id is internal to Gitorious a=
nd<br>
&gt; is meaningless without also providing further information, like email<=
br>
&gt; address, name, public ssh key, or some such thing.<br>
&gt;<br>
&gt; All of those could be seen as potential privacy issues; for instance,<=
br>
&gt; you might think the email address would be obvious, but what if a pers=
on<br>
&gt; is committing under a different email address than what they&#39;ve gi=
ven to<br>
&gt; Gitorious?<br>
&gt;<br>
&gt; --Jeff<br>
&gt;<br>
<br>
</div></div>I still don&#39;t understand why we need access to email addres=
ses from some<br>
gitorious database anyways. if you want to push to a kde repo, you have to =
be<br>
in the kde-developers group. we can require people to agree to whatever&#39=
;s<br>
needed at the time they join that group. all we need is a log of which kde<=
br>
developer pushed what, right?<br>
everything else you can get from a git clone...<br>
<font color=3D"#888888"><br></font></blockquote><div><br>The problem is tha=
t your email address according to Git and your kde-developers group members=
hip are not necessarily related, so there is no guaranteed way to map the c=
ommit back to the person that commited.<br>
<br>My suggestion is to have a pre-commit hook that compares the email addr=
ess on the commit message to the list of subscribers to kde-cvs-announce (o=
r bugzilla) and if it isn&#39;t found, reject the commit. We&#39;ll need a =
mechanism for syncing this list, but it should not be an unsurmountable hur=
dle.<br>
=A0</div><blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid =
rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><font co=
lor=3D"#888888">
--<br>
This message brought to you by eevil bananas and the number 3.<br>
<a href=3D"http://www.chani3.com" target=3D"_blank">www.chani3.com</a><br>
</font><br>_______________________________________________<br>
Kde-scm-interest mailing list<br>
<a href=3D"mailto:Kde-scm-interest@kde.org">Kde-scm-interest@kde.org</a><br=
>
<a href=3D"https://mail.kde.org/mailman/listinfo/kde-scm-interest" target=
=3D"_blank">https://mail.kde.org/mailman/listinfo/kde-scm-interest</a><br>
<br></blockquote></div><br>

--0016e6d9a2c75677b004785cac0f--

--===============0660210129==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Kde-scm-interest mailing list
Kde-scm-interest@kde.org
https://mail.kde.org/mailman/listinfo/kde-scm-interest

--===============0660210129==--