git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Add .gitconfig variable commit.gpg-sign

From
SGSebastian Götte <jaseg@physik.tu-berlin.de>
Date
Apr 24, 2013, 08:53 UTC
Message-ID
<51779DA1.7080606@physik.tu-berlin.de>
In-Reply-To
<CAASwCXcs8Q7qGWSNKttEuk0zPetDWNCse4J-KSm20r9h5XSo3Q@mail.gmail.com>
On 04/23/2013 09:56 PM, Joel Jacobson wrote:
Show 20 quoted lines
>> But stepping back a bit, I have a suspicion that your upstream
>> project _only_ cares about what you feed them (either by pushing
>> your work yourself to them, or telling them to pull from your
>> repository).  There is no reason for you to be constantly signing
>> your commits you make during your exploratory development that you
>> may throw-away in the end.
> 
> Your suspicions are correct.
> But I'm a bit paranoid, so it feels better to sign even local commits.
> 
>> It _might_ be a better option to just teach "-S" option to "git
>> rebase" that tells it to replay all the commits with "commit -S",
>> instead of adding commit.gpgSign configuration.
> 
> In my case, I don't do that much exploratory development locally,
> so I usually just commit, pull and push.
> 
> Always signing everything can't really hurt, can it? Takes a few clock
> cycles more, and a few more bytes, but apart from that I don't see any
> problems?

I have my GPG-keys password-protected, and I would be severely annoyed by GnuPG password prompts popping up on every commit. I think the -S option to rebase would be the more elegant way. What could be nice would be a config option that makes "git push" warn/abort in case I try to push an unsigned head commit to a repo where I want to have signed commits:

> remote.<name>.abortUnsigned
This of course needs an command line override switch.

Something to be considered is whether "git rebase -S" should sign *every* commit in the series or only the *head* commit.

Previous: Joel JacobsonNext: Michael J Gruber
Message 8 of 15 in “Re: [PATCH] Add .gitconfig variable commit.gpg-sign”
  1. Junio C HamanoApr 22, 2013
  2. Joel JacobsonApr 23, 2013
  3. Michael J GruberApr 23, 2013
  4. Junio C HamanoApr 23, 2013
  5. Joel JacobsonApr 23, 2013
  6. Junio C HamanoApr 23, 2013
  7. Joel JacobsonApr 23, 2013
  8. Sebastian GötteApr 24, 2013
  9. Michael J GruberApr 24, 2013
  10. 1/1 templates: pre-push hook: check for missing GPG signatures (was: Re: [PATCH] Add .gitconfig variable commit.gpg-sign)Sebastian Götte, Apr 24, 2013
  11. Junio C HamanoApr 24, 2013
  12. 0/1 templates: pre-push hook: check for missing GPG signaturesSebastian Götte, Apr 25, 2013
  13. Junio C HamanoApr 25, 2013
  14. Junio C HamanoApr 23, 2013
  15. 1/1 templates: pre-push hook: check for missing GPG signaturesSebastian Götte, Apr 25, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.