Re: [FFmpeg-devel] rebasing security

2025-08-12 Thread Timo Rothenpieler
On 8/12/2025 7:04 PM, Marton Balint wrote: On Tue, 5 Aug 2025, Kacper Michajlow wrote: On Mon, 4 Aug 2025 at 23:38, Marton Balint wrote: - Previously it was pretty clear from git history who actually committed    a change from the comitter field. With using forgejo the comitter    field

Re: [FFmpeg-devel] rebasing security

2025-08-12 Thread Marton Balint
On Tue, 5 Aug 2025, Kacper Michajlow wrote: On Mon, 4 Aug 2025 at 23:38, Marton Balint wrote: - Previously it was pretty clear from git history who actually committed a change from the comitter field. With using forgejo the comitter field no longer shows the person who actually *c

Re: [FFmpeg-devel] rebasing security

2025-08-06 Thread Michael Niedermayer
Hi On Wed, Aug 06, 2025 at 08:51:01AM +0200, Alexander Strasser via ffmpeg-devel wrote: > On 2025-08-06 00:37 +0200, Michael Niedermayer wrote: > > > > On Mon, Aug 04, 2025 at 10:15:53PM +0200, Alexander Strasser via > > ffmpeg-devel wrote: > [...] > > > > > > If I understand the original poin

Re: [FFmpeg-devel] rebasing security

2025-08-05 Thread Alexander Strasser via ffmpeg-devel
On 2025-08-06 00:37 +0200, Michael Niedermayer wrote: > > On Mon, Aug 04, 2025 at 10:15:53PM +0200, Alexander Strasser via ffmpeg-devel > wrote: [...] > > > > If I understand the original point you wanted to discuss correctly, > > than this is not a question of rebase or merge but one of letting

Re: [FFmpeg-devel] rebasing security

2025-08-05 Thread Michael Niedermayer
Hi Alexander On Mon, Aug 04, 2025 at 10:15:53PM +0200, Alexander Strasser via ffmpeg-devel wrote: > Hi Michael, > hi all! > > I think it's a good time to bring stuff like this up for discussion. > > On 2025-08-03 21:02 +0200, Michael Niedermayer wrote: > > > > On Sun, Aug 03, 2025 at 05:31:39P

Re: [FFmpeg-devel] rebasing security

2025-08-05 Thread Alexander Strasser via ffmpeg-devel
On 2025-08-05 05:06 +0200, Kacper Michajlow wrote: > On Mon, 4 Aug 2025 at 23:38, Marton Balint wrote: > > > > On Mon, 4 Aug 2025, Alexander Strasser via ffmpeg-devel wrote: [...] > > > > > > If I understand the original point you wanted to discuss correctly, > > > than this is not a question of r

Re: [FFmpeg-devel] rebasing security

2025-08-04 Thread Jacob Lifshay
On Mon, Aug 4, 2025 at 8:06 PM Kacper Michajlow wrote: > Slightly related, I don't like how simple the web ui commit log of > forgejo is, it doesn't show commiter at all. For me this information > is as important as the author. I'm keeping notes on forgejo usage and > will share it when the time c

Re: [FFmpeg-devel] rebasing security

2025-08-04 Thread Kacper Michajlow
On Tue, 5 Aug 2025 at 05:06, Kacper Michajlow wrote: > > On Mon, 4 Aug 2025 at 23:38, Marton Balint wrote: > > > > > > > > On Mon, 4 Aug 2025, Alexander Strasser via ffmpeg-devel wrote: > > > > > Hi Michael, > > > hi all! > > > > > > I think it's a good time to bring stuff like this up for discus

Re: [FFmpeg-devel] rebasing security

2025-08-04 Thread Kacper Michajlow
On Mon, 4 Aug 2025 at 23:38, Marton Balint wrote: > > > > On Mon, 4 Aug 2025, Alexander Strasser via ffmpeg-devel wrote: > > > Hi Michael, > > hi all! > > > > I think it's a good time to bring stuff like this up for discussion. > > > > On 2025-08-03 21:02 +0200, Michael Niedermayer wrote: > >> > >

Re: [FFmpeg-devel] rebasing security

2025-08-04 Thread Marton Balint
On Mon, 4 Aug 2025, Alexander Strasser via ffmpeg-devel wrote: Hi Michael, hi all! I think it's a good time to bring stuff like this up for discussion. On 2025-08-03 21:02 +0200, Michael Niedermayer wrote: On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: [...] The sol

Re: [FFmpeg-devel] rebasing security

2025-08-04 Thread Alexander Strasser via ffmpeg-devel
Hi Michael, hi all! I think it's a good time to bring stuff like this up for discussion. On 2025-08-03 21:02 +0200, Michael Niedermayer wrote: > > On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: > [...] > > The solutions are obvious: > > 1. ignore security and supply chain a

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Timo Rothenpieler
On 8/3/2025 10:29 PM, Michael Niedermayer wrote: Hi Timo On Sun, Aug 03, 2025 at 10:01:42PM +0200, Timo Rothenpieler wrote: On 8/3/2025 9:02 PM, Michael Niedermayer wrote: Hi On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: [...] The solutions are obvious: 1. ignore secur

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Michael Niedermayer
Hi Timo On Sun, Aug 03, 2025 at 10:01:42PM +0200, Timo Rothenpieler wrote: > On 8/3/2025 9:02 PM, Michael Niedermayer wrote: > > Hi > > > > On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: > > [...] > > > The solutions are obvious: > > > 1. ignore security and supply chain att

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Timo Rothenpieler
On 8/3/2025 9:02 PM, Michael Niedermayer wrote: Hi On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: [...] The solutions are obvious: 1. ignore security and supply chain attacks 2. use merges not rebases on the server 3. rebase locally, use fast forward only 4. verify on serv

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Michael Niedermayer
Hi On Sun, Aug 03, 2025 at 05:31:39PM +0200, Michael Niedermayer wrote: [...] > The solutions are obvious: > 1. ignore security and supply chain attacks > 2. use merges not rebases on the server > 3. rebase locally, use fast forward only > 4. verify on server rebases Maybe not everyone understood

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Michael Niedermayer
Hi On Sun, Aug 03, 2025 at 05:38:26PM +0200, Timo Rothenpieler wrote: > On 8/3/2025 5:31 PM, Michael Niedermayer wrote: > > Hi > > > > The "on server rebase" process that we are using with forgejo looks a bit > > insecure > > > > Previously we wrote code, discussed and then signed and pushed >

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread James Almer
On 8/3/2025 12:38 PM, Timo Rothenpieler wrote: On 8/3/2025 5:31 PM, Michael Niedermayer wrote: Hi The "on server rebase" process that we are using with forgejo looks a bit insecure Previously we wrote code, discussed and then signed and pushed In this setup the code coming from a develo

Re: [FFmpeg-devel] rebasing security

2025-08-03 Thread Timo Rothenpieler
On 8/3/2025 5:31 PM, Michael Niedermayer wrote: Hi The "on server rebase" process that we are using with forgejo looks a bit insecure Previously we wrote code, discussed and then signed and pushed In this setup the code coming from a developer is not manipulatable because noone else

[FFmpeg-devel] rebasing security

2025-08-03 Thread Michael Niedermayer
Hi The "on server rebase" process that we are using with forgejo looks a bit insecure Previously we wrote code, discussed and then signed and pushed In this setup the code coming from a developer is not manipulatable because noone else can sign it Even if its not signed, stuff would