Re: Commit signing

From: Matthias Kestenholz <lists@spinlock.ch>
Date: Jan 15, 2007, 10:13 UTC
Message-ID: <1168856014.16129.35.camel@localhost.localdomain>
In-Reply-To: <200701151000.58609.andyparkins@gmail.com>

On Mon, 2007-01-15 at 10:00 +0000, Andy Parkins wrote:

Show 7 quoted lines

> Hello,
> 
> I was just talking to another developer in my office about version control.  
> He's working with Windows so has chosen Monotone for a version control 
> system.  I didn't have any huge objections, as I'm sure monotone can be 
> migrated to git without much trouble (they look to support the same features 
> from my brief reading).

The decision to use SHA1 hashes for all objects comes from Monotone, so the design has to be somewhat similar.

Show 5 quoted lines

> Of course my favourite is git, but we were talking about the certificates 
> needed by monotone for each developer.  I assume that monotone therefore 
> signs every commit.  It obviously crossed my mind as to how one would do that 
> with git?  We obviously already have the ability to sign a tag, but is there 
> a way in which one could sign every commit.

You'd need to automatically generate a signed tag for every commit (for example in a post-commit hook? Or use a wrapper script for git-commit which runs git-tag -s afterwards)

Show 7 quoted lines

> 
> The more I think about it, the more it could be a reasonable question.  In my 
> own repository I can obviously create whatever commits i like, claiming them 
> to be from whomever I like just by altering a few config settings.  If I put 
> a few of those in my own repository and then managed to persuade Junio to 
> pull from me - wouldn't I have faked commits from another developer?  
> However, I wouldn't be able to fake a gpg signature.

You just explained why no one should pull from people he does not trust.

I think it would be overkill to sign every single commit, signed tags are enough to sign the whole history (as everyone should know by now).

Matthias