From: Sitaram Chamarty <sitaramc@gmail.com>
Date: Fri, 17 Apr 2009 03:42:07 GMT
Subject: Re: GPG signing for git commit?
Message-ID: <slrngufuke.1am.sitaramc@sitaramc.homelinux.net>
In-Reply-To: <20090416142728.GG23604@spearce.org>

On 2009-04-16, Shawn O. Pearce <spearce@spearce.org> wrote:
>> The other downside to relying on SSH presentation of identity directly,
>> is the inability to use the SSH key to uniquely identify the user during
>> the SSH auth (see designs like gitosis, where you always push to
>> git+ssh://git@host/repo).
>
> Uhm, yea.  That's a fault of gitosis then.  It knows the key that
> was used, and has that mapped back to some token that identifies that
> account in the configuration file.  Why it doesn't push that into the
> GIT_COMMITTER_* environment before launching git-shell, I don't know.

If you set GIT_COMMITTER_*, won't it change the SHA of the
commit itself?  I always thought so...

One possibility is to set "LogLevel VERBOSE" in
/etc/ssh/sshd_config and save those logs -- they can help
you match up the timestamps in the reflogs and find out who
pushed what, subject to all the other caveats in Shawn's
earlier post.

But it's a kludge... sadly my python-fu is zero; I really
wish gitosis would put that info *somewhere*.