git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: GPG signing for git commit?

From
Nguyen Thai Ngoc Duy <pclouds@gmail.com>
Date
May 10, 2009, 22:53 UTC
Message-ID
<fcaeb9bf0905101553p56f5e8b2o6e6b550e9494b726@mail.gmail.com>
In-Reply-To
<robbat2.20090508T190254.538956494Z@orbis-terrarum.net>
On Sat, May 9, 2009 at 5:03 AM, Robin H. Johnson <robbat2@gentoo.org> wrote:
Show 8 quoted lines
>> How about signing the tree SHA-1 and putting the signature in commit
>> message? It's like gpg way of saying Signed-off-by. If the committer
>> wants to sign again before pushing out, he could amend the commit,
>> append his signature there; or make a no-change commit to contain his
>> signature (probably from git-commit-tree because iirc git-commit won't
>> let you make no-change commit)
> Hmm, I like the sound of that, but I'm concerned it might be difficult
> to enforce. If rewrite-history ever happens, it's also invalidated.

Well if you rewrite and touch the trees, then every signature should be invalidated anyway. If you only touch commit message, it should remain valid because I only sign trees.

-- 
Duy
Previous: Robin H. JohnsonNext: Nguyen Thai Ngoc Duy
Message 14 of 17 in “GPG signing for git commit?”
  1. Chow Loong JinApr 3, 2009
  2. Linus TorvaldsApr 3, 2009
  3. Sam VilainApr 6, 2009
  4. Robin H. JohnsonApr 15, 2009
  5. Shawn O. PearceApr 15, 2009
  6. Robin H. JohnsonApr 15, 2009
  7. Shawn O. PearceApr 16, 2009
  8. Sitaram ChamartyApr 17, 2009
  9. Jeff KingApr 17, 2009
  10. Sitaram ChamartyApr 17, 2009
  11. Jeff KingApr 21, 2009
  12. Nguyen Thai Ngoc DuyMay 7, 2009
  13. Robin H. JohnsonMay 8, 2009
  14. Nguyen Thai Ngoc DuyMay 10, 2009
  15. Nguyen Thai Ngoc DuyMay 11, 2009
  16. Jakub NarebskiApr 7, 2009
  17. Linus TorvaldsApr 7, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.