git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Tracability in git commits

From
Martin Langhoff <martin.langhoff@gmail.com>
Date
May 1, 2008, 07:34 UTC
Message-ID
<46a038f90805010034y3ffd3eb5hbee7c2200912eef3@mail.gmail.com>
In-Reply-To
<46a038f90804301826xaf5d73bl1d29a07bc930a716@mail.gmail.com>

On Thu, May 1, 2008 at 1:26 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:

Show 7 quoted lines
>   4 - A script "pushes" commits from the "incoming" repo to a
>  "verified" repo after checking that they are backed by a GPG-signed
>  list. For ease of use, this can happen on the server ASAP, and it can
>  be validated independently by any party. Notably, it is probably a
>  good idea that it is validated shortly before a release is tagged.
>
>  This way, you keep the flexible/fast properties of git

Note that with this, you *can* also keep the ability for someone to push commits that they are not the author or committer for. This is actually added flexibility - you can merge from a 3rd party tree, and push it to the central repo, as long as you GPG-sign the list including those commits.

I highlight "can" because the wrapper on the developer side and the script on the server side can prevent this, or force extra steps in such case.

cheers,
m
-- 
 martin.langhoff@gmail.com
 martin@laptop.org -- School Server Architect
 - ask interesting questions
 - don't get distracted with shiny stuff - working code first
 - http://wiki.laptop.org/go/User:Martinlanghoff
Previous: Martin LanghoffNext: Junio C Hamano
Message 13 of 15 in “Tracability in git commits”
  1. Richard PurdieApr 29, 2008
  2. Johannes SchindelinApr 29, 2008
  3. Junio C HamanoApr 29, 2008
  4. Richard PurdieApr 29, 2008
  5. Shawn O. PearceApr 30, 2008
  6. Ping YinApr 30, 2008
  7. Miklos VajnaApr 30, 2008
  8. Shawn O. PearceMay 1, 2008
  9. Ping YinMay 1, 2008
  10. Jakub NarebskiApr 30, 2008
  11. Richard PurdieApr 30, 2008
  12. Martin LanghoffMay 1, 2008
  13. Martin LanghoffMay 1, 2008
  14. Junio C HamanoMay 1, 2008
  15. Martin LanghoffMay 1, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.