{"thread":{"id":"34145","subject":"Teams of people using signed commits...","startedAt":"2013-06-14T19:02:01Z","lastAt":"2013-06-14T22:06:27Z","messageCount":3,"participants":["Eric Fleischman","Magnus Bäck","Fredrik Gustafsson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"220905","messageId":"CABQymNKuwiOz-MQuM12fWSgBvBsBrykNYBqPBxCuSuxAC5cZZw@mail.gmail.com","threadId":"34145","inReplyTo":null,"subject":"Teams of people using signed commits...","fromName":"Eric Fleischman","fromEmail":"efleischman@gmail.com","sentAt":"2013-06-14T19:02:01Z","receivedAt":"2013-06-14T19:02:01Z","isPatch":false,"sender":{"key":"efleischman@gmail.com","avatar":null},"body":"We're very interested in using signed commits but are struggling to\nfigure out how to use it in the real world. Would love some advice\nfrom those who know more.\n\nWe think we know how to deal with signed commits & auto-reject such\ncommits at build time, as well as clean up. But we're worried that\nfolks won't sign on the way in accidentally. We don't know of a good\nway to force the team to always sign commits yet, especially as they\nget new machines and what hav eyou.\n\nIs there a way to add something to the repo config to force, or at\nleast default, this?\nWe considered forking git and forcing this on the team, forcing them\nto sign for our repos. But we'd love to avoid this sort of\nheavy-handed approach.\n\nThx!\nEric\n"},{"id":"220906","messageId":"20130614192526.GA25486@google.com","threadId":"34145","inReplyTo":"CABQymNKuwiOz-MQuM12fWSgBvBsBrykNYBqPBxCuSuxAC5cZZw@mail.gmail.com","subject":"Re: Teams of people using signed commits...","fromName":"Magnus Bäck","fromEmail":"baeck@google.com","sentAt":"2013-06-14T19:25:27Z","receivedAt":"2013-06-14T19:25:27Z","isPatch":false,"sender":{"key":"baeck@google.com","avatar":null},"body":"On Friday, June 14, 2013 at 15:02 EDT,\n Eric Fleischman wrote:\n\n> We're very interested in using signed commits but are struggling to\n> figure out how to use it in the real world. Would love some advice\n> from those who know more.\n\nWhat do you expect to gain from using signed commits? I'm not saying\nthey don't have a place, but depending on why you find them attractive\nthere might be alternatives. For example, won't signed tags do?\n\n> We think we know how to deal with signed commits & auto-reject such\n> commits at build time, as well as clean up. But we're worried that\n> folks won't sign on the way in accidentally. We don't know of a good\n> way to force the team to always sign commits yet, especially as they\n> get new machines and what hav eyou.\n\nHooks? A pre-commit hook that runs on the machine and/or a server-side\nhook (pre-receive or update?) should be able to enforce this. Well, a\nclient hook is trivially bypassed so it would just be useful against\nmistakes and forgetfullness.\n\n> Is there a way to add something to the repo config to force, or at\n> least default, this?\n\nI don't believe you can configure Git to sign commits by default, but\nif you control the machine of your machines (assuming a corporate)\nenvironment you can set up a template directory for hook distribution.\nAgain, that's only for client hooks that are okay to be circumventable.\n\n[...]\n\n-- \nMagnus Bäck\nbaeck@google.com\n"},{"id":"220920","messageId":"20130614220627.GA371@paksenarrion.iveqy.com","threadId":"34145","inReplyTo":"CABQymNKuwiOz-MQuM12fWSgBvBsBrykNYBqPBxCuSuxAC5cZZw@mail.gmail.com","subject":"Re: Teams of people using signed commits...","fromName":"Fredrik Gustafsson","fromEmail":"iveqy@iveqy.com","sentAt":"2013-06-14T22:06:27Z","receivedAt":"2013-06-14T22:06:27Z","isPatch":false,"sender":{"key":"iveqy@iveqy.com","avatar":"https://avatars.githubusercontent.com/u/761743?v=4"},"body":"On Fri, Jun 14, 2013 at 12:02:01PM -0700, Eric Fleischman wrote:\n> We think we know how to deal with signed commits & auto-reject such\n> commits at build time, as well as clean up. But we're worried that\n> folks won't sign on the way in accidentally. We don't know of a good\n> way to force the team to always sign commits yet, especially as they\n> get new machines and what hav eyou.\n> \n> Is there a way to add something to the repo config to force, or at\n> least default, this?\n> We considered forking git and forcing this on the team, forcing them\n> to sign for our repos. But we'd love to avoid this sort of\n> heavy-handed approach.\n> \n> Thx!\n> Eric\n\nHi,\nI might miss something here, but couldn't you just write a pre-commit\nhook on the client side to help the developers remember and a post-receive\nhook on the server side to actually enforce this?\n\nWith that said, I'm a bit skeptical about enforcing ways to use\nsoftware. It usually hide real social problems instead. For example, if\nyour developers doesn't understand the value in always signing their\ncommits, can you trust that they protect their gpg-key well enough?\n-- \nMed vänliga hälsningar\nFredrik Gustafsson\n\ntel: 0733-608274\ne-post: iveqy@iveqy.com\n"}]}