git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Git-commits mailing list feed.

From
PJPaul Jakma <paul@clubi.ie>
Date
Apr 25, 2005, 03:47 UTC
Message-ID
<Pine.LNX.4.62.0504250443380.14200@sheen.jakma.org>
In-Reply-To
<Pine.LNX.4.62.0504250435050.14200@sheen.jakma.org>
On Mon, 25 Apr 2005, Paul Jakma wrote:
Show 7 quoted lines
> Uh, I have no idea whether verifying a signature of a commit object is 
> sufficient, ie equivalent to signing each file.
>
> commit refers to tree objects, which I presume lists the SHA-1 object IDs of 
> files, but IIRC Linus already described why a signature of the commit object 
> should not be used to trust the rest of commit.. (i'll have to find his 
> mail). If so, an index is required.
Ah, apparently it is sufficient:
Linus:

“Just signing the commit is indeed sufficient to just say "I trust this commit". But I essentially what to also say what I trust it _for_ as well.”

So this would work for commit objects.

It would also work for tag objects, if you pointed people at the signature object rather than the actual tag object.

regards,
-- 
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
Fortune:
Humor in the Court:
Q.  Were you aquainted with the deceased?
A.  Yes, sir.
Q.  Before or after he died?
Previous: Paul JakmaNext: Andreas Gal
Message 35 of 55 in “Re: Git-commits mailing list feed.”
  1. David WoodhouseApr 21, 2005
  2. Linus TorvaldsApr 23, 2005
  3. Linus TorvaldsApr 23, 2005
  4. Fabian FranzApr 23, 2005
  5. Andreas GalApr 23, 2005
  6. SeanApr 23, 2005
  7. Thomas GlanzmannApr 23, 2005
  8. SeanApr 23, 2005
  9. Linus TorvaldsApr 23, 2005
  10. Thomas GlanzmannApr 23, 2005
  11. Linus TorvaldsApr 23, 2005
  12. SeanApr 23, 2005
  13. Linus TorvaldsApr 23, 2005
  14. SeanApr 23, 2005
  15. Linus TorvaldsApr 23, 2005
  16. Junio C HamanoApr 23, 2005
  17. Linus TorvaldsApr 23, 2005
  18. Junio C HamanoApr 23, 2005
  19. Paul JakmaApr 24, 2005
  20. Paul JakmaApr 24, 2005
  21. David A. WheelerApr 25, 2005
  22. Paul JakmaApr 25, 2005
  23. David A. WheelerApr 25, 2005
  24. Paul JakmaApr 25, 2005
  25. Paul JakmaApr 25, 2005
  26. Linus TorvaldsApr 25, 2005
  27. Fabian FranzApr 25, 2005
  28. Andreas GalApr 25, 2005
  29. Linus TorvaldsApr 25, 2005
  30. David A. WheelerApr 25, 2005
  31. David GreavesApr 25, 2005
  32. David A. WheelerApr 25, 2005
  33. Paul JakmaApr 25, 2005
  34. Paul JakmaApr 25, 2005
  35. Paul JakmaApr 25, 2005
  36. New option (-H) for rpush/rpull to update HEADAndreas Gal, Apr 25, 2005
  37. Daniel BarkalowApr 25, 2005
  38. Andreas GalApr 25, 2005
  39. Daniel BarkalowApr 25, 2005
  40. Matt DomschApr 25, 2005
  41. Jan HarkesApr 25, 2005
  42. Thomas GlanzmannApr 23, 2005
  43. Thomas GlanzmannApr 23, 2005
  44. Jan HarkesApr 23, 2005
  45. Linus TorvaldsApr 23, 2005
  46. Junio C HamanoApr 23, 2005
  47. Jan HarkesApr 23, 2005
  48. Linus TorvaldsApr 23, 2005
  49. Jan HarkesApr 23, 2005
  50. Git transfer protocols (was: Re: Git-commits mailing list feed)Mike Taht, Apr 23, 2005
  51. Jan HarkesApr 23, 2005
  52. Linus TorvaldsApr 23, 2005
  53. Suggestion: generalize signed tags into "assertion objects"David A. Wheeler, Apr 23, 2005
  54. Jeff GarzikApr 23, 2005
  55. David WoodhouseApr 25, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.