Authentication of revision committer

[Daniel Schierbeck]

In branch views <https://code.edge.launchpad.net/~spiv/bzr/make-branch-and-tree-fix> , it seems the committer of a revision is linked to if the email part matches a Launchpad user.

One can easily spoof the committer email address, making ones commits appear to be someone else's.

Perhaps use GPG verification?

[Diogo Matsubara (matsubara)]

Tim, what do you think?

This is similar to bug 190758

[Tim Penhey (thumper)]

I think Aaron is able to provide a better comment on this.

[Aaron Bentley (abentley)]

In theory, doing authentication is just a matter of tying our existing bits together. Launchpad can validate a GPG signature. bzr can verify that the signed testament is correct. Once we can perform validation, we'll probably want to store this in a database attribute, e.g. an enum.

However, there are many states:
Validated with the committer's key
Validated with some other key
Unknown key
No signature
Signed with a known key, and not valid
Incorrectly signed

No signature will be a very, very common case. Bazaar itself doesn't support checking signatures, so the incentive to sign is small.

I suggest that in the web UI, we mark validated revisions specially, and mark revisions that failed validation specially. Revisions with no signature would display normally.

I'm not sure what to suggest about about revisions signed with some other key. Maybe add extra text saying who signed it if it isn't the committer. This case may be so rare that we don't need to bother with it.