Re: rebase has no --verify-signatures

From: Alexander 'z33ky' Hirsch <1zeeky@gmail.com>
Date: Dec 9, 2015, 23:20 UTC
Message-ID: <20151209232015.GA1923@blarch>
In-Reply-To: <20151208012125.GD990758@vauxhall.crustytoothpaste.net>

On Tue, Dec 08, 2015 at 01:21:25AM +0000, brian m. carlson wrote:

Show 13 quoted lines

> On Mon, Dec 07, 2015 at 03:00:15PM +0100, Alexander 'z33ky' Hirsch wrote:
> > Is there any technical reason why rebase should not have a
> > --verify-signatures flag? I have written a patch to git-rebase--am
> > which enables it to do such a check. If there is no reason not to
> > include it I'd add documentation and a test and submit it.
> 
> As far as I know, there is no technical reason that it shouldn't.  It's
> probably that nobody has implemented it yet.  I'd certainly be
> interested in such a patch.
> 
> For a thorough change, you'd probably want to make it work with
> git-rebase--merge and git-rebase--interactive as well.  I'm sure I'm not
> the only person who frequently uses rebase -m.

Ah, rebase -m. That sounds nice, I didn't know about this feature. In fact, I first tried to write the code in git-rebase--merge, thinking this is the default rebase script.

git-rebase--interactive sounds a bit more difficult since you could easily modify commits, thereby removing previously GPG signed commits. Although this sounds like all the more reason why it would be useful to check for it.

I'll look at the script and ponder about it. I'll post whatever I come up with on Thursday (probably) or Friday. I'll put you in the CC when I post the patch.

Regards, Alexander Hirsch