From: Matěj Cepl Date: Thu, 20 Oct 2022 17:29:35 GMT Subject: Re: git-send-email with GPG signed commits? Message-ID: In-Reply-To: <20221020124612.xivhb4xk52yvy5nk@meerkat.local> Dne 20. 10. 22 v 14:46 Konstantin Ryabitsev napsal(a): >> did anybody even think about %subj%? Is there some effort somewhere making >> git-send-email(1) supporting transfer of signed commits, where I could join? >> I like hosting sites like sr.ht, which support git-send-email(1), but >> unfortunately using that clears my submission off its GPG signatures. I >> guess, it would be necessary to make some modifications to git-send-email(1) >> and git-am(1). Is there some effort somewhere in that direction? > > Linux Kernel supports end-to-end attested patches (including using PGP), but > the implementation took a slightly different direction, because there are > important downsides to PGP-signed messages when it comes to patch workflows. > > See the following project: > https://pypi.org/project/patatt/ Hmm, that's very interesting and it seems that at least somehow sr.ht has to work with (https://is.gd/qea0gF), but if I understand it correctly the GPG signature is on the email, not on the commit, so git-am(1) (or even b4 shazam) sees just unsigned commit and when pushed to GitHub/GitLab or any other repository which knows about signing git commits, it doesn’t get green check-mark, right? Although, the line “you can use PGP keys to sign git tags/commits, not just mailed patches” in the README makes me wonder. Hmm, I should probably ask on the sr.ht list. Thank you for the response, Matěj -- https://matej.ceplovi.cz/blog/, Jabber: mcepl@ceplovi.cz GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8 в чужой монастырь со своим уставом не ходят. -- Russian proverb (this time actually checked by a native Russian)