git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] merge/pull: verify GPG signatures of commits being merged

From
Jonathan Nieder <jrnieder@gmail.com>
Date
Mar 22, 2013, 23:14 UTC
Message-ID
<20130322231430.GK12223@google.com>
In-Reply-To
<514CD26C.2070702@physik.tu-berlin.de>
Hi,
Sebastian Götte wrote:
Show 5 quoted lines
> git merge/pull:
> When --verify-signatures is specified on the command-line of git-merge
> or git-pull, check whether the commits being merged have good gpg
> signatures and abort the merge in case they do not. This allows e.g.
> auto-deployment from untrusted repo hosts.

This leaves me pretty nervous. Is there an argument to pass in to specify a keyring with public keys to trust? Without that, it is presumably using ~/.gnupg/trustdb.gpg, which is about trust of identity rather than trust to provide code to run on my machine. :(

If there's a good way to avoid that, this looks like a good thing to do, though.

Hope that helps, Jonathan

Previous: Junio C HamanoNext: Junio C Hamano
Message 3 of 4 in “merge/pull: verify GPG signatures of commits being merged”
  1. merge/pull: verify GPG signatures of commits being mergedSebastian Götte, Mar 22, 2013
  2. Junio C HamanoMar 22, 2013
  3. Jonathan NiederMar 22, 2013
  4. Junio C HamanoMar 23, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.