git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [git patches] libata updates, GPG signed (but see admin notes)

From
David Woodhouse <dwmw2@infradead.org>
Date
Nov 10, 2011, 13:51 UTC
Message-ID
<1320933118.17392.23.camel@i7.infradead.org>
In-Reply-To
<CA+55aFyG4VuiRN3kcyDVF4sw7b89m-2bOBeQLOGWTcd9o3akzQ@mail.gmail.com>
On Wed, 2011-11-02 at 21:13 -0700, Linus Torvalds wrote:
> No, my main objection to saving the data is that it's ugly and it's
> redundant. Sure, in practice you can check the signatures later fine
> (with the rare exceptions you mention), but even when you can do it,
> what's the big upside?

Another objection (although it may not be insurmountable) is that it's not necessarily *entirely* clear what's being signed.

In the simple case where I clone your tree, make a few commits with my Signed-off-by:, sign a tag and then ask you to pull, that's easy enough. I'm vouching for what I committed, and not for everything that was in your tree beforehand.

But what if I'm working on top of someone else's published git tree? Does a signed tag at the top of *my* work imply that I'm vouching for all of theirs too?

In the case where the signature is ephemeral and only used for you to trust my pull request, the answer is simple: If that other work wasn't in your tree yet at the time I send my pull request, I'd damn well better be vouching for it when I ask you to pull it. Nothing new there.

But if we're keeping signatures around for auditing purposes, we'd better have a coherent answer to that question. One that isn't "a signature cover everything since the last commit with torvalds@ as the committer", if we want it to be useful for the general case.

-- 
dwmw2
Previous: Linus TorvaldsNext: Marc Branchaud
Message 40 of 81 in “Re: [git patches] libata updates, GPG signed (but see admin notes)”
  1. Ingo MolnarOct 31, 2011
  2. Junio C HamanoOct 31, 2011
  3. Ingo MolnarOct 31, 2011
  4. Junio C HamanoOct 31, 2011
  5. Ted Ts'oOct 31, 2011
  6. Junio C HamanoOct 31, 2011
  7. Linus TorvaldsOct 31, 2011
  8. H. Peter AnvinOct 31, 2011
  9. Linus TorvaldsOct 31, 2011
  10. H. Peter AnvinOct 31, 2011
  11. Linus TorvaldsOct 31, 2011
  12. Junio C HamanoOct 31, 2011
  13. Linus TorvaldsOct 31, 2011
  14. Ingo MolnarNov 2, 2011
  15. Jochen StriepeNov 2, 2011
  16. Junio C HamanoOct 31, 2011
  17. Junio C HamanoOct 31, 2011
  18. H. Peter AnvinOct 31, 2011
  19. Ted Ts'oOct 31, 2011
  20. H. Peter AnvinOct 31, 2011
  21. Linus TorvaldsOct 31, 2011
  22. H. Peter AnvinOct 31, 2011
  23. Linus TorvaldsOct 31, 2011
  24. James BottomleyNov 1, 2011
  25. Jeff GarzikOct 31, 2011
  26. H. Peter AnvinNov 1, 2011
  27. Jiri KosinaOct 31, 2011
  28. Junio C HamanoNov 1, 2011
  29. Linus TorvaldsNov 1, 2011
  30. Junio C HamanoNov 1, 2011
  31. Linus TorvaldsNov 2, 2011
  32. Junio C HamanoNov 2, 2011
  33. Shawn PearceNov 3, 2011
  34. Linus TorvaldsNov 3, 2011
  35. Linus TorvaldsNov 3, 2011
  36. Shawn PearceNov 3, 2011
  37. Linus TorvaldsNov 3, 2011
  38. Jochen StriepeNov 3, 2011
  39. Linus TorvaldsNov 3, 2011
  40. David WoodhouseNov 10, 2011
  41. Marc BranchaudNov 10, 2011
  42. Linus TorvaldsNov 3, 2011
  43. Linus TorvaldsNov 3, 2011
  44. Junio C HamanoNov 4, 2011
  45. Junio C HamanoNov 4, 2011
  46. Linus TorvaldsNov 4, 2011
  47. Jeff KingNov 5, 2011
  48. Junio C HamanoNov 5, 2011
  49. Junio C HamanoNov 3, 2011
  50. Junio C HamanoNov 3, 2011
  51. Linus TorvaldsNov 3, 2011
  52. Ted Ts'oNov 4, 2011
  53. Linus TorvaldsNov 4, 2011
  54. valdis.kletnieks@vt.eduNov 7, 2011
  55. Linus TorvaldsNov 7, 2011
  56. Junio C HamanoNov 5, 2011
  57. Linus TorvaldsNov 5, 2011
  58. Junio C HamanoNov 5, 2011
  59. Linus TorvaldsNov 6, 2011
  60. Junio C HamanoNov 9, 2011
  61. Johan HerlandNov 10, 2011
  62. Junio C HamanoNov 10, 2011
  63. Johan HerlandNov 10, 2011
  64. Junio C HamanoNov 10, 2011
  65. Johan HerlandNov 11, 2011
  66. Junio C HamanoNov 11, 2011
  67. Junio C HamanoNov 10, 2011
  68. Linus TorvaldsNov 3, 2011
  69. Junio C HamanoNov 4, 2011
  70. Linus TorvaldsNov 4, 2011
  71. Jeff KingNov 3, 2011
  72. Robin H. JohnsonNov 3, 2011
  73. Junio C HamanoNov 3, 2011
  74. Ted Ts'oNov 1, 2011
  75. Junio C HamanoNov 2, 2011
  76. david@lang.hmNov 2, 2011
  77. Linus TorvaldsNov 2, 2011
  78. David WoodhouseNov 10, 2011
  79. Michael J GruberNov 2, 2011
  80. Junio C HamanoNov 2, 2011
  81. Michael J GruberNov 2, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.