Re: [PATCH v5 0/6] fast-export, fast-import: add support for signed-commits

>
> On Mon, Feb 24, 2025 at 11:35:00PM -0800, Elijah Newren wrote:
> > On Mon, Feb 24, 2025 at 9:01 AM Junio C Hamano <gitster@pobox.com> wrote:
> > >
> > > Christian Couder <christian.couder@gmail.com> writes:
> > >
> > > > Luke Shumaker sent the first 4 versions of this series in April 2021,
> > > > but it looks like he stopped before it got merged. Let's finish
> > > > polishing it.
> > >
> > > Nice to see an old topic resurrected.
> > >
> > > > fast-export has an existing --signed-tags= option that controls how to
> > > > handle tag signatures.  However, there is no equivalent for commit
> > > > signatures; it just silently strips the signature out of the commit
> > > > (analogously to --signed-tags=strip).
> > > >
> > > > So implement a --signed-commits= flag in fast-export, and implement
> > > > the receiving side of it in fast-import.
> > >
> > > Nice.
> > >
> > > I haven't thought about this topic obviously for a looooong time,
> > > but I wonder we may want to have an option, which is independent
> > > from these --signed-tags/--signed-commits options addressed here,
> > > that allows the person who performed the import to attest to the
> > > result by adding their own signature on tags and commits, whether
> > > these tags and commits were originally signed or not.
> >
> > For what it's worth, this has been requested multiple times of
> > git-filter-repo, so there is some desire for this feature.
>
> This is also exactly the usecase we have been reviving this effort for
> :) We recently hit such a case where a customer was basically unable to
> use git-filter-repo(1) due to commit signatures, so we wanted to help
> out and get this patch series landed so that the issue can ultimately be
> addressed in git-filter-repo(1).