git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [Request for Documentation] Differentiate signed (commits/tags/pushes)

From
Tom Jones <tom@oxix.org>
Date
Mar 7, 2017, 09:45 UTC
Message-ID
<20170307094549.GB23052@dufour.oxix.org>
In-Reply-To
<20170307092353.ibirvitsxhzn3apz@sigill.intra.peff.net>

We use git to manage a config management repository for some servers. We have tens of signed commits a day; all get deployed. The logic on each host is roughly "is signed by sysadmin key and is more recent than currently-deployed version".

Also, what is all this about "GPG"? The protocol is OpenPGP. A particular implementation is GnuPG / gpg. It is completely mad that this implementation detail is in the interface specs for git, such as --gpg-sign for git-commit(1).

It is an indictment of a lack of appreciation of the relationship between interfaces and implementations, and the importance of proper treatment thereof.

If Bob creates Bob's git compatible program, and he happens to use Bob's OpenPGP implementation, his compatible option for git-commit(1) still has to be called "--gpg-sign". Madness.

  Tom.
Previous: Jeff KingNext: Stefan Beller
Message 10 of 13 in “[Request for Documentation] Differentiate signed (commits/tags/pushes)”
  1. Stefan BellerMar 6, 2017
  2. Junio C HamanoMar 6, 2017
  3. Stefan BellerMar 6, 2017
  4. Junio C HamanoMar 7, 2017
  5. Stefan BellerMar 7, 2017
  6. Jakub NarębskiMar 6, 2017
  7. Junio C HamanoMar 7, 2017
  8. Junio C HamanoMar 6, 2017
  9. Jeff KingMar 7, 2017
  10. Tom JonesMar 7, 2017
  11. Stefan BellerMar 7, 2017
  12. Jeff KingMar 8, 2017
  13. Matthieu MoyMar 7, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.