Re: How to gpg signed email patches?

From: Matt Hunter <m@lfurio.us>
Date: Apr 13, 2025, 22:21 UTC
Message-ID: <D95V0Z9YMEX2.3J99CE4F6ZP8S@lfurio.us>
In-Reply-To: <fx2ofmmhkjmjqfqya5e3qvmovvmpnjepteqobcz4eia5sw64bg@yquuljpwok3f>

Hi

On Sun Apr 13, 2025 at 3:17 PM EDT, Klaus Frank wrote:

Show 5 quoted lines

> how do I get "git send-email" to send the patches gpg signed? I tried
> first signing the commit but after spending time looking into the
> documentation I couldn't work out how to do it. All I discovered so far
> is that the "git send-email" appears to be using "git format-patch"
> internally and that's where it currently gets lost.

There's a conceptual issue with mailing patches from signed commits. Once your patch recipient goes to apply it to their branch, they are recorded as the "committer" identity of the new commit object. This would break the validity of any existing signature.

This is likely the reason by the related git tools (format-patch, am) ignore this information.

You may have also noticed that commands like git-rebase and git-cherry-pick will drop signatures from commits as well, since they are being replayed onto a different history, changing the commit data.