Re: [PATCH] merge/pull: verify GPG signatures of commits being merged

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 23, 2013, 03:08 UTC
Message-ID: <7vvc8i4xtm.fsf@alter.siamese.dyndns.org>
In-Reply-To: <20130322231430.GK12223@google.com>

Jonathan Nieder <jrnieder@gmail.com> writes:

Show 10 quoted lines

>> git merge/pull:
>> When --verify-signatures is specified on the command-line of git-merge
>> or git-pull, check whether the commits being merged have good gpg
>> signatures and abort the merge in case they do not. This allows e.g.
>> auto-deployment from untrusted repo hosts.
>
> This leaves me pretty nervous.  Is there an argument to pass in to
> specify a keyring with public keys to trust?  Without that, it is
> presumably using ~/.gnupg/trustdb.gpg, which is about trust of
> identity rather than trust to provide code to run on my machine. :(

I think people who create a real merge via "git pull" and use that as "auto-deployment" mechanism is insane, but presumably that "auto" tells us some other things, like it will be done by non-human account, its $HOME/.gnupg would contain only the keyring that is for the auto deployer, or the cronscript that runs "git pull" can set GNUPGHOME and export it before doing so.

So, I wouldn't be worried about it too much.