Re: git-send-email with GPG signed commits?

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 20, 2022, 17:48 UTC
Message-ID: <xmqqr0z2s7w4.fsf@gitster.g>
In-Reply-To: <Y1GJAart+/yFc5MR@coredump.intra.peff.net>

Jeff King <peff@peff.net> writes:

Show 9 quoted lines

> So commit signatures are generally an attestation by the committer, not
> by the author. It's just that the two are usually the same when you are
> committing locally.
>
> I think you would need some kind of "author-sig" header that signs the
> commit object bytes _without_ the commit header at all. And that assumes
> the maintainer's workflow is to never modify a patch in transit, and to
> apply it at the exact same spot that you wrote it (so that the parent
> and tree ids remain the same).

Doesn't it immediately break down once you send a 2-patch series? You may be able to get the bottom one right, but the top one needs to depend on the commit object name of the result of applying the bottom one.

It depends on what they are trying to achieve by transferrring with existing signature intact. If they truly want to preserve the validity of the signatures on commits, they are better off exchanging bundles over e-mail, as reviewers and integrators are not even allowed to touch anything.