On 07/10/2018 11:23 AM, Ian Jackson wrote:
> Wei Liu writes ("Re: [PATCH 2/2] MAINTAINERS: use https for git trees"):
>> On Tue, Jul 10, 2018 at 02:36:49AM -0600, Jan Beulich wrote:
>>> On 10.07.18 at 10:15, <[email protected]> wrote:
>>>> Signed-off-by: Wei Liu <[email protected]>
>>>
>>> What's wrong with git:// ? I think the commit message should be non-
>>> empty here.
>>
>> git: is not encrypted, while https: is. At this time of age, it is
>> better to use encryption as much as possible.
>
> I agree with this change, so
>
> Acked-by: Ian Jackson <[email protected]>
>
>
> Let me expand on Wei's reasons:
>
> The git protocol is not just unencrypted, but also unauthenticated.
> In theory it is possible to verify the signed tags for actual
> releases, but that is a cumbersome process which I very much doubt
> anyone really does.
>
> As for the various branch tips, there is currently no way (unless you
> have a shell account on xenbits) to get any kind of authenticated
> value.
>
> Conversely, if you use an https url, you get some cryptographic
> authentication of what you are cloning. The crypto there is far from
> perfect but it is massively better than nothing.
I agree with this logic, but it should have been in the commit message.
-George
_______________________________________________
Xen-devel mailing list
[email protected]
https://lists.xenproject.org/mailman/listinfo/xen-devel
