Re: [PATCH v5 0/6] fast-export, fast-import: add support for signed-commits

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 24, 2025, 17:01 UTC
Message-ID: <xmqq1pvn6zvg.fsf@gitster.g>
In-Reply-To: <20250224142744.279643-1-christian.couder@gmail.com>

Christian Couder <christian.couder@gmail.com> writes:

> Luke Shumaker sent the first 4 versions of this series in April 2021,
> but it looks like he stopped before it got merged. Let's finish
> polishing it.

Nice to see an old topic resurrected.

Show 7 quoted lines

> fast-export has an existing --signed-tags= option that controls how to
> handle tag signatures.  However, there is no equivalent for commit
> signatures; it just silently strips the signature out of the commit
> (analogously to --signed-tags=strip).
>
> So implement a --signed-commits= flag in fast-export, and implement
> the receiving side of it in fast-import.

Nice.

I haven't thought about this topic obviously for a looooong time, but I wonder we may want to have an option, which is independent from these --signed-tags/--signed-commits options addressed here, that allows the person who performed the import to attest to the result by adding their own signature on tags and commits, whether these tags and commits were originally signed or not.

Obviously totally independent, orthogonal, and outside of the scope of this topic.

Thanks.