Re: [PATCH v3 3/3] fast-export, fast-import: implement signed-commits

From: Elijah Newren <newren@gmail.com>
Date: Apr 29, 2021, 22:38 UTC
Message-ID: <CABPp-BHhfT3b=UyWOXACrBb6nw86n74thNAx7DUDF0YNOcA-yA@mail.gmail.com>
In-Reply-To: <87o8dwq2hv.wl-lukeshu@lukeshu.com>

On Thu, Apr 29, 2021 at 1:06 PM Luke Shumaker <lukeshu@lukeshu.com> wrote:

Show 6 quoted lines

>
> On Tue, 27 Apr 2021 22:02:47 -0600,
> Junio C Hamano wrote:
> >
> > Luke Shumaker <lukeshu@lukeshu.com> writes:
> >

Show 12 quoted lines

> > > +--signed-commits=(verbatim|warn-verbatim|warn-strip|strip|abort)::
> > > +   Specify how to handle signed commits.  Behaves exactly as
> > > +   --signed-tags (but for commits), except that the default is
> > > +   'warn-strip' rather than 'abort'.
> >
> > Why deliberate inconsistency?  I am not sure "historically we did a
> > wrong thing" is a good reason (if we view that silently stripping
> > was a disservice to the users, aborting would be a bugfix).
>
> I *almost* agree.  I agree in principle, but disagree in practice
> because I know that it would break a bunch of existing tooling,
> including git-filter-repo.

I understand that fast-export's behavior in the past matched what --signed-commits=warn-strip would now do, and thus you wanted to select it for backward compatibility. But throwing an error and making the user choose when they are potentially losing data seems like a safer choice to me.

I do get that we might have to use warn-strip as the default anyway just because some existing tools might rely on it, but do you have any examples outside of git-filter-repo? Given the filter-repo bug reports I've gotten with users being surprised at commit signatures being stripped (despite the fact that this is documented -- users don't always read the documentation), I'd argue that changing to --signed-commits=abort as the default is probably a good bugfix for both fast-export and for filter-repo.

Clearly, it'd probably make sense for filter-repo to also add an option for the user to select to: (0) abort if commit signatures are found, (1) strip commit signatures, (2) retain commit signatures even if they are invalid, or (3) only retain commit signatures if they are valid. In the past, we could only reasonably do (1). Your series makes (0) and (2) possible. More work in fast-import would be needed to make (3) a possibility, so I wouldn't be able to add it to filter-repo yet, but I could add the other options.