Re: [PATCH 0/3] fast-export, fast-import: implement signed-commits

> 
> On Mon, Apr 19, 2021 at 3:54 PM Luke Shumaker <lukeshu@lukeshu.com> wrote:
> >
> > From: Luke Shumaker <lukeshu@datawire.io>
> >
> > fast-export has an existing --signed-tags= flag that controls how to
> > handle tag signatures.  However, there is no equivalent for commit
> > signatures; it just silently strips the signature out of the commit
> > (analogously to --signed-tags=strip).
> >
> > So implement a --signed-commits= flag in fast-export, and implement
> > the receiving side of it in fast-import.
> 
> I understand adding an option to fast-export, but shouldn't there also
> be one for fast-import?  In particular, I can see users wanting any of
> the following:
> 
> * I want these signatures exported and imported because I know I won't
> tweak them and they'll still be valid.
> * I want these signatures even though they'll be invalid.  Whatever,
> I'll just deal with it.
> * I want the signatures exported and imported *when they will remain
> valid*.  Always exporting them makes sense, because fast-export
> doesn't know about tweaks I'll be making to its output before feeding
> it to fast-import.  But fast-import should have options to
> strip-if-invalid/warn-if-invalid/error-if-invalid/import-without-warning
> for these tags (though they don't have to use these exact names).
> 
> I know fast-import doesn't do anything of the sort for signed tags,
> but fast-import also doesn't support signed tags as per this comment
> in the documentation:
> 
> """
> Signing annotated tags during import from within fast-import is not
> supported.  Trying to include your own PGP/GPG signature is not
> recommended, as the frontend does not (easily) have access to the
> complete set of bytes which normally goes into such a signature.
> If signing is required, create lightweight tags from within fast-import with
> `reset`, then create the annotated versions of those tags offline
> with the standard 'git tag' process.
> """
> 
> it just happens to "work" since the signature is part of the
> annotation and fast-import doesn't attempt to read or validate the
> annotation in any way, treating it as free-from text.  I'd say users
> relying on this are on somewhat shaky ground.
> 
> But here you're adding explicit fast-import directives to the language
> for signatures of commits, so you clearly do need to care.  And I
> suspect fast-import's default should be error-if-invalid rather than
> import-without-warning.