git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: gpg verify git sub modules useful?

From
Junio C Hamano <gitster@pobox.com>
Date
Feb 28, 2017, 17:36 UTC
Message-ID
<xmqqmvd6kykc.fsf@gitster.mtv.corp.google.com>
In-Reply-To
<a9da4416-6437-a491-f461-c5e61d805b2d@riseup.net>
Patrick Schleizer <patrick-mailinglists@whonix.org> writes:
> When using git submodules, is there value in iterating about the git
> submodules running "git verfiy-commit HEAD" or would that be already
> covered by the git submodule verification?

That depends on what you are referring to with the "git submodule verification" and more importantly what threat you are guarding against. "git -C <submodule-dir> verify-commit HEAD" may make sure that the contents of that commit object is GPG signed by whoever you trust--is that what you want to make sure? Or do you want all commits in the submodule history to be similarly signed because the tree of the superproject can switch to some other commit there?

Previous: Patrick SchleizerNext: Patrick Schleizer
Message 2 of 4 in “gpg verify git sub modules useful?”
  1. Patrick SchleizerFeb 28, 2017
  2. Junio C HamanoFeb 28, 2017
  3. Patrick SchleizerMar 1, 2017
  4. Stefan BellerMar 1, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.