From: Junio C Hamano <gitster@pobox.com>
Date: Fri, 13 Jun 2014 17:06:10 GMT
Subject: Re: [PATCH 3/3] verify-commit: scriptable commit signature verification
Message-ID: <xmqqbntw4u4d.fsf@gitster.dls.corp.google.com>
In-Reply-To: <20140613110901.GB14066@sigill.intra.peff.net>

Jeff King <peff@peff.net> writes:

> I realize this isn't really your itch to scratch. It's just that when I
> see a description like "verify a commit", I wonder what exactly "verify"
> means.

I think that is an important point.  If a tool only verifies the
signature of the commit when conceivably other aspect of it could
also be verified but we cannot decide how or we decide we should not
dictate one-way-fits-all, using a generic name "verify-commit" or
"verify" without marking that it is currently only on the signature
clearly somewhere might close the door to the future.

    git verify <object>::
        Verify whatever we currently deem is appropriate for the
        given type of object.

    git verify --gpg-signature::
	Verify the GPG signature for a signed tag, a signed commit,
        or a merge with signed tags.

    git verify --commit-author <committish>::
	Verify the GPG signer matches the "author " header of the
	commit.

and more, perhaps?