Re: GPG signing for git commit?

From: Sitaram Chamarty <sitaramc@gmail.com>
Date: Apr 17, 2009, 03:42 UTC
Message-ID: <slrngufuke.1am.sitaramc@sitaramc.homelinux.net>
In-Reply-To: <20090416142728.GG23604@spearce.org>

On 2009-04-16, Shawn O. Pearce <spearce@spearce.org> wrote:

Show 9 quoted lines

>> The other downside to relying on SSH presentation of identity directly,
>> is the inability to use the SSH key to uniquely identify the user during
>> the SSH auth (see designs like gitosis, where you always push to
>> git+ssh://git@host/repo).
>
> Uhm, yea.  That's a fault of gitosis then.  It knows the key that
> was used, and has that mapped back to some token that identifies that
> account in the configuration file.  Why it doesn't push that into the
> GIT_COMMITTER_* environment before launching git-shell, I don't know.

If you set GIT_COMMITTER_*, won't it change the SHA of the commit itself? I always thought so...

One possibility is to set "LogLevel VERBOSE" in /etc/ssh/sshd_config and save those logs -- they can help you match up the timestamps in the reflogs and find out who pushed what, subject to all the other caveats in Shawn's earlier post.

But it's a kludge... sadly my python-fu is zero; I really wish gitosis would put that info *somewhere*.