{"thread":{"id":"61476","subject":"Author signature","startedAt":"2024-05-14T19:26:57Z","lastAt":"2024-06-04T15:19:09Z","messageCount":6,"participants":["Dimitri Sabadie","brian m. carlson","Konstantin Ryabitsev"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"494734","messageId":"D19KZ1CBA7JF.27PYPL5X68543@strongly-typed-thoughts.net","threadId":"61476","inReplyTo":null,"subject":"Author signature","fromName":"Dimitri Sabadie","fromEmail":"hadronized@strongly-typed-thoughts.net","sentAt":"2024-05-14T18:31:55Z","receivedAt":"2024-05-14T19:26:57Z","isPatch":false,"sender":{"key":"hadronized@strongly-typed-thoughts.net","avatar":null},"body":"Hello!\n\nI’ve moved away from the PR/MR git workflow to the email one and I’ve\nbeen delighted by it. However, there is one thing that feels a bit like\na regression to me.\n\nOn the PR/MR workflow, if someone wants to contribute to my project,\nthey can simply make a couple of commits and open a “Pull Request” or\n“Merge Request.” Once reviewed, I can decide to merge via several\noptions:\n\n* Creating a merge commit.\n* Rebasing their commits.\n* Asking the UI of the (centralized) system (GitHub, GitLab, etc.) to do\n\nWhatever is decided, the commits end up in my repository and the author\nmight have signed the commits and their signature is still there.\n\nWith the email workflow, from what I understand, `git am` has no way to\nkeep the signature of the author — and I have not found anything going\nthat direction with `git send-email` and `git format-patch`, and I think\nthat the reason why is because the commit is modified to introduce the\ncommitter (committer being me here; the author being the contributor who\nsent the patch), whence the commit SHA changes. The author signature is\nsimply dropped, and `git log --show-signature` only shows my GPG\nsignature; not the author’s anymore!\n\nSo… I was wondering: since we can only sign commits, is there any\nway / work in progress to attach the author signature to a commit? To\nme, it would make sense to have something hierarchical: the comitter\nsimply signs above what the author signed, and the author doesn’t sign\nthe whole commit (I guess?), since we want to be able to change the\ncommit hash.\n\nWhat do you think?\n\nCheers,\nDimitri\n"},{"id":"494737","messageId":"ZkPA2Pmz2EB6SOzL@tapette.crustytoothpaste.net","threadId":"61476","inReplyTo":"D19KZ1CBA7JF.27PYPL5X68543@strongly-typed-thoughts.net","subject":"Re: Author signature","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2024-05-14T19:51:52Z","receivedAt":"2024-05-14T19:51:54Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2024-05-14 at 18:31:55, Dimitri Sabadie wrote:\n> With the email workflow, from what I understand, `git am` has no way to\n> keep the signature of the author — and I have not found anything going\n> that direction with `git send-email` and `git format-patch`, and I think\n> that the reason why is because the commit is modified to introduce the\n> committer (committer being me here; the author being the contributor who\n> sent the patch), whence the commit SHA changes. The author signature is\n> simply dropped, and `git log --show-signature` only shows my GPG\n> signature; not the author’s anymore!\n\n`git send-email` does not send a signature, correct.  I've proposed an\napproach to add such a signature in the past as part of a more general\nseries, but it hasn't been implemented.\n\n> So… I was wondering: since we can only sign commits, is there any\n> way / work in progress to attach the author signature to a commit? To\n> me, it would make sense to have something hierarchical: the comitter\n> simply signs above what the author signed, and the author doesn’t sign\n> the whole commit (I guess?), since we want to be able to change the\n> commit hash.\n\nThis is a great question.  I have seen previous requests for author and\ncommitter signatures, or in general, multiple signatures (such as with\nco-authors).  Git has only one signature field (well, two if you could\nthe one for the SHA-1 encoding and the SHA-256 encoding), but OpenPGP\ndoes allow multiple signatures to be embedded in one ASCII-armored blob.\n\nSo it is in theory possible to take the author signature and _add_ a\ncommitter signature and have both be valid, although this will change\nthe object ID of the commit.  However, Git doesn't support that right\nnow, although there's no reason it couldn't be added for OpenPGP.  I\ndon't know whether it's possible for X.509 to have multiple signatures,\nand I don't get the impression that OpenSSH supports it (but haven't\nchecked).\n\nI was doing some test work on this within the past week, and I have a\nvague desire to implement such a thing, but no definitive plans at the\nmoment.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"},{"id":"494745","messageId":"20240514-lively-potoo-of-sorcery-0028de@lemur","threadId":"61476","inReplyTo":"ZkPA2Pmz2EB6SOzL@tapette.crustytoothpaste.net","subject":"Re: Author signature","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2024-05-14T20:03:50Z","receivedAt":"2024-05-14T20:03:51Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Tue, May 14, 2024 at 07:51:52PM GMT, brian m. carlson wrote:\n> > So… I was wondering: since we can only sign commits, is there any\n> > way / work in progress to attach the author signature to a commit? To\n> > me, it would make sense to have something hierarchical: the comitter\n> > simply signs above what the author signed, and the author doesn’t sign\n> > the whole commit (I guess?), since we want to be able to change the\n> > commit hash.\n> \n> This is a great question.  I have seen previous requests for author and\n> committer signatures, or in general, multiple signatures (such as with\n> co-authors).  Git has only one signature field (well, two if you could\n> the one for the SHA-1 encoding and the SHA-256 encoding), but OpenPGP\n> does allow multiple signatures to be embedded in one ASCII-armored \n> blob.\n\nIt's worth noting the gittuf work that was recently profiled on LWN [1].  \nIt does already integrate the concept of multiple signatures via in-toto \nattestations [2].\n\nI feel like it's a better approach than overloading the currently \nimplemented signature support.\n\n-K\n\n[1]: https://lwn.net/Articles/973217/\n[2]: https://github.com/gittuf/gittuf/blob/main/docs/design-document.md#attestations\n"},{"id":"494746","messageId":"20240514-demonic-quartz-hog-be2bd2@lemur","threadId":"61476","inReplyTo":"20240514-lively-potoo-of-sorcery-0028de@lemur","subject":"Re: Author signature","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2024-05-14T20:05:38Z","receivedAt":"2024-05-14T20:05:42Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Tue, May 14, 2024 at 04:03:50PM GMT, Konstantin Ryabitsev wrote:\n> [1]: https://lwn.net/Articles/973217/\n\nFixing the link:\nhttps://lwn.net/Articles/972467/\n\n(Unfortunately, it's still subscriber-only until 2 days from now.)\n\n-K\n"},{"id":"496278","messageId":"20240604-omniscient-skinny-dormouse-bfae0a@lemur","threadId":"61476","inReplyTo":"D1R8VB91BRR6.3M3651RXOQM5Q@strongly-typed-thoughts.net","subject":"Re: Author signature","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2024-06-04T13:12:19Z","receivedAt":"2024-06-04T13:12:23Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Tue, Jun 04, 2024 at 02:50:49PM GMT, Dimitri Sabadie wrote:\n> On the other side, I just had another idea. What would be best to me\n> is to actually provide a _proof_ that at least the author acknowledges\n> the patch — whether he wrote it or not is another story and I don’t\n> think we can enforce that completely. The goal I want to achieve is that\n> if I send a patch via email, if the patch ends up committed by someone\n> else, I still want to be able to have a proof that “I wrote the patch.”\n\nOn the kernel side of things, we're using patatt for this purpose:\nhttps://github.com/mricon/patatt\n\n> So assuming the committer is not of bad faith and doesn’t truncate my\n> git commit message… why not simply adding a “sign-off” like line at the\n> end of the commit, but instead of just putting a clear text that anyone\n> could tamper with, we would sign the date at which the commit was made?\n> \n> For instance, I could have a git message like:\n> \n>     Fix typo. \n> \n>   \t-----BEGIN PGP SIGNED MESSAGE-----\n>     Hash: SHA512\n> \n>     Tue Jun  4 02:49:26 PM CEST 2024\n>     -----BEGIN PGP SIGNATURE-----\n> \n>     iHUEARYKAB0WIQRsmRqgbXp8KFc3mc6pQ4aopiUuywUCZl8NVgAKCRCpQ4aopiUu\n>     yyhWAQCScfP28Py0QbHuqzzOFyjAMwdK0LfwiGfYrfzfv0evlAD9Hd+x8NgvPq2p\n>     nnnG5tQaHeIS/v8PMP0suy3QiWV8WQc=\n>     =Ru+m\n>     -----END PGP SIGNATURE-----\n> \n> If a create another commit later with \"Fix typo.\" as content, then the\n> date will be different and the signature won’t be the same.\n> \n> What do you think?\n\nNo, this is not a good solution, if only because the date of the commit can be\nfreely edited to match whatever is in the signature, and then it can be reused\nfor any commit at all.\n\n-K\n\n"},{"id":"496283","messageId":"D1R8VB91BRR6.3M3651RXOQM5Q@strongly-typed-thoughts.net","threadId":"61476","inReplyTo":"20240514-demonic-quartz-hog-be2bd2@lemur","subject":"Re: Author signature","fromName":"Dimitri Sabadie","fromEmail":"hadronized@strongly-typed-thoughts.net","sentAt":"2024-06-04T12:50:49Z","receivedAt":"2024-06-04T15:19:09Z","isPatch":false,"sender":{"key":"hadronized@strongly-typed-thoughts.net","avatar":null},"body":"On the other side, I just had another idea. What would be best to me\nis to actually provide a _proof_ that at least the author acknowledges\nthe patch — whether he wrote it or not is another story and I don’t\nthink we can enforce that completely. The goal I want to achieve is that\nif I send a patch via email, if the patch ends up committed by someone\nelse, I still want to be able to have a proof that “I wrote the patch.”\n\nSo assuming the committer is not of bad faith and doesn’t truncate my\ngit commit message… why not simply adding a “sign-off” like line at the\nend of the commit, but instead of just putting a clear text that anyone\ncould tamper with, we would sign the date at which the commit was made?\n\nFor instance, I could have a git message like:\n\n    Fix typo. \n\n  \t-----BEGIN PGP SIGNED MESSAGE-----\n    Hash: SHA512\n\n    Tue Jun  4 02:49:26 PM CEST 2024\n    -----BEGIN PGP SIGNATURE-----\n\n    iHUEARYKAB0WIQRsmRqgbXp8KFc3mc6pQ4aopiUuywUCZl8NVgAKCRCpQ4aopiUu\n    yyhWAQCScfP28Py0QbHuqzzOFyjAMwdK0LfwiGfYrfzfv0evlAD9Hd+x8NgvPq2p\n    nnnG5tQaHeIS/v8PMP0suy3QiWV8WQc=\n    =Ru+m\n    -----END PGP SIGNATURE-----\n\nIf a create another commit later with \"Fix typo.\" as content, then the\ndate will be different and the signature won’t be the same.\n\nWhat do you think?\n\nDimitri\n"}]}