Gerrit prevents upstreaming patches from others

[Paul Menzel]

Dear Christian,


On 02/06/17 10:55, Christian Lohmaier wrote:

> On Thu, Feb 2, 2017 at 1:05 PM, Paul Menzel wrote:
>>
>> I was asked to push a commit for review to the LO Gerrit instance [1].
>>
>> The patch is from a colleague, who is denoted as the commit author. No
>> Gerrit complains, that I am not the author, and my colleagues email address
>> is not registered to *my* Gerrit account.
>
> This is intentional.
>
>> Could you please change that, and disable that limitation? I don’t see any
>> reason for it.
>
> It is to prevent people from impersonating somebody else.
>
> Think about someone trying your email to introduce a backdoor ...

In my opinion that’s highly hypothetical. And if that happens, it’ll be 
figured out in no time from the Gerrit log, that it wasn’t really the 
impersonated person.

> as well as reducing mistakes (when you're  using different email
> addresses, and didn't configure your email...

Then you would still get that warning, as your committer data is also 
not matched.

The coreboot project doesn’t have these restrictions, and in the past 
there hasn’t been any problems.

Have there been actual problems in the past?

>> At least the committer address should also be looked at. Or some kind of
>> Signed-off-by procedure.
>
> That is already in place, as mentioned by Jan.

At least it’s not documented.


Kind regards,

Paul