linux-kernel - Re: [GIT PULL REQUEST] watchdog

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 17 Dec 2017 13:20:17 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Wim Van Sebroeck <wim@...ana.be>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux Watchdog Mailing List <linux-watchdog@...r.kernel.org>,
        Guenter Roeck <linux@...ck-us.net>
Subject: Re: [GIT PULL REQUEST] watchdog - v4.15 Fixes

On Sun, Dec 17, 2017 at 12:12 PM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> Also, all of these commits were committed less than an hour before
> sending me the pull request, so I question the kind of testing they
> got..

Oh, and equally importantly, it's an unsigned pull request from a
non-secured site, so I think I'll skip this.

Yes, yes, I've allowed these guys, and haven't really enforced it, but
the rule for the last year or so has been that if it's not something
where I have good reason to trust the repository integrity (ie
kernel.org), I require signed tags for pull requests.

I note that the watchdog pulls I have from Guenter _are_ signed (and
also from kernel.org). And I don't have Wim's key in my keyring at
all, so presumably they've never been signed, but can we please start
doing that? Git signed tags are pretty darn simple to use.

                Linus