Re: git-send-email with GPG signed commits?
- From
Matěj Cepl <mcepl@cepl.eu>
- Date
- Oct 20, 2022, 17:29 UTC
- Message-ID
- <a2b0abfa-3533-b22b-1e8f-5be4c00163ce@cepl.eu>
- In-Reply-To
- <20221020124612.xivhb4xk52yvy5nk@meerkat.local>
Dne 20. 10. 22 v 14:46 Konstantin Ryabitsev napsal(a):
Show 13 quoted lines
>> did anybody even think about %subj%? Is there some effort somewhere making >> git-send-email(1) supporting transfer of signed commits, where I could join? >> I like hosting sites like sr.ht, which support git-send-email(1), but >> unfortunately using that clears my submission off its GPG signatures. I >> guess, it would be necessary to make some modifications to git-send-email(1) >> and git-am(1). Is there some effort somewhere in that direction? > > Linux Kernel supports end-to-end attested patches (including using PGP), but > the implementation took a slightly different direction, because there are > important downsides to PGP-signed messages when it comes to patch workflows. > > See the following project: > https://pypi.org/project/patatt/
Hmm, that's very interesting and it seems that at least somehow sr.ht has to work with (https://is.gd/qea0gF), but if I understand it correctly the GPG signature is on the email, not on the commit, so git-am(1) (or even b4 shazam) sees just unsigned commit and when pushed to GitHub/GitLab or any other repository which knows about signing git commits, it doesn’t get green check-mark, right? Although, the line “you can use PGP keys to sign git tags/commits, not just mailed patches” in the README makes me wonder.
Hmm, I should probably ask on the sr.ht list.
Thank you for the response,
Matěj
--
https://matej.ceplovi.cz/blog/, Jabber: mcepl@ceplovi.cz
GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8
в чужой монастырь со своим уставом не ходят.
-- Russian proverb (this time actually checked by a native
Russian)