git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: GPG signing for git commit?

From
Robin H. Johnson <robbat2@gentoo.org>
Date
Apr 15, 2009, 22:29 UTC
Message-ID
<20090415T220710Z@curie.orbis-terrarum.net>
In-Reply-To
<20090415192054.GE23604@spearce.org>
On Wed, Apr 15, 2009 at 12:20:54PM -0700, Shawn O. Pearce wrote:
Show 6 quoted lines
> > Not sure of the best route to trace this data. Signing the SHA1 makes
> > the most sense, but need to be able to do that without polluting the tag
> > namespace.
> Have the PM push over SSH, and don't ever expire reflogs on the
> central repository?  The reflog will have the old and new commits
> and the user name of the PM.
All pushing to the central repo will be git+ssh:// anyway.

I don't follow where the PM's identity is being stored, and how that's distributed back out with the later pulls.

The other downside to relying on SSH presentation of identity directly, is the inability to use the SSH key to uniquely identify the user during the SSH auth (see designs like gitosis, where you always push to git+ssh://git@host/repo).

-- 
Robin Hugh Johnson
Gentoo Linux Developer & Infra Guy
E-Mail     : robbat2@gentoo.org
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85
Previous: Shawn O. PearceNext: Shawn O. Pearce
Message 6 of 17 in “GPG signing for git commit?”
  1. Chow Loong JinApr 3, 2009
  2. Linus TorvaldsApr 3, 2009
  3. Sam VilainApr 6, 2009
  4. Robin H. JohnsonApr 15, 2009
  5. Shawn O. PearceApr 15, 2009
  6. Robin H. JohnsonApr 15, 2009
  7. Shawn O. PearceApr 16, 2009
  8. Sitaram ChamartyApr 17, 2009
  9. Jeff KingApr 17, 2009
  10. Sitaram ChamartyApr 17, 2009
  11. Jeff KingApr 21, 2009
  12. Nguyen Thai Ngoc DuyMay 7, 2009
  13. Robin H. JohnsonMay 8, 2009
  14. Nguyen Thai Ngoc DuyMay 10, 2009
  15. Nguyen Thai Ngoc DuyMay 11, 2009
  16. Jakub NarebskiApr 7, 2009
  17. Linus TorvaldsApr 7, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.