Re: [PATCH] Add .gitconfig variable commit.gpg-sign

From: Joel Jacobson <joel@trustly.com>
Date: Apr 23, 2013, 19:56 UTC
Message-ID: <CAASwCXcs8Q7qGWSNKttEuk0zPetDWNCse4J-KSm20r9h5XSo3Q@mail.gmail.com>
In-Reply-To: <7v1ua1hwx6.fsf@alter.siamese.dyndns.org>

On Tue, Apr 23, 2013 at 8:25 PM, Junio C Hamano <gitster@pobox.com> wrote:

> Yup.
>
> And then we would need to add the same option to existing callers of
> "git commit" (such as "git rebase") to pass it down the callchain.

Got it.

Show 6 quoted lines

> But stepping back a bit, I have a suspicion that your upstream
> project _only_ cares about what you feed them (either by pushing
> your work yourself to them, or telling them to pull from your
> repository).  There is no reason for you to be constantly signing
> your commits you make during your exploratory development that you
> may throw-away in the end.

Your suspicions are correct. But I'm a bit paranoid, so it feels better to sign even local commits.

> It _might_ be a better option to just teach "-S" option to "git
> rebase" that tells it to replay all the commits with "commit -S",
> instead of adding commit.gpgSign configuration.

In my case, I don't do that much exploratory development locally, so I usually just commit, pull and push.

Always signing everything can't really hurt, can it? Takes a few clock cycles more, and a few more bytes, but apart from that I don't see any problems?