From: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
Date: Thu, 20 Oct 2022 12:46:12 GMT
Subject: Re: git-send-email with GPG signed commits?
Message-ID: <20221020124612.xivhb4xk52yvy5nk@meerkat.local>
In-Reply-To: <4eb8707f-4686-e304-2aab-a6afee11abc9@cepl.eu>

On Thu, Oct 20, 2022 at 06:26:49AM +0200, Matěj Cepl wrote:
> Hello,
> 
> did anybody even think about %subj%? Is there some effort somewhere making
> git-send-email(1) supporting transfer of signed commits, where I could join?
> I like hosting sites like sr.ht, which support git-send-email(1), but
> unfortunately using that clears my submission off its GPG signatures. I
> guess, it would be necessary to make some modifications to git-send-email(1)
> and git-am(1). Is there some effort somewhere in that direction?

Linux Kernel supports end-to-end attested patches (including using PGP), but
the implementation took a slightly different direction, because there are
important downsides to PGP-signed messages when it comes to patch workflows.

See the following project:
https://pypi.org/project/patatt/

There is a section on that page that describes why PGP-signed patches aren't
the preferred way to go for many people.

Best regards,
Konstantin