git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [Request for Documentation] Differentiate signed (commits/tags/pushes)

From
Junio C Hamano <gitster@pobox.com>
Date
Mar 7, 2017, 00:16 UTC
Message-ID
<xmqqzigyx7o5.fsf@junio-linux.mtv.corp.google.com>
In-Reply-To
<47ad8b6d-0a65-2f8c-dcc5-49a8a8d5ab2a@gmail.com>
Jakub Narębski <jnareb@gmail.com> writes:
Show 5 quoted lines
> Also from what I remember signed commits came before mergetags, that
> is the result of merging a signed tag (storing the signature of
> one of parents of the merge commit to not pollute tag namespace).
>
> And this workflow, from what I know, is quite useful.

The "commit -s" on a merge commit lets you as the integrator to attest that you made that merge. The "mergetag" records the signature by the contributor that says the tip that was merged was what the contributor wanted to get merged.

It is entirely reasonable to sign a merge commit that merges a signed tag. They serve two different and unrelated purposes.

Previous: Jakub NarębskiNext: Junio C Hamano
Message 7 of 13 in “[Request for Documentation] Differentiate signed (commits/tags/pushes)”
  1. Stefan BellerMar 6, 2017
  2. Junio C HamanoMar 6, 2017
  3. Stefan BellerMar 6, 2017
  4. Junio C HamanoMar 7, 2017
  5. Stefan BellerMar 7, 2017
  6. Jakub NarębskiMar 6, 2017
  7. Junio C HamanoMar 7, 2017
  8. Junio C HamanoMar 6, 2017
  9. Jeff KingMar 7, 2017
  10. Tom JonesMar 7, 2017
  11. Stefan BellerMar 7, 2017
  12. Jeff KingMar 8, 2017
  13. Matthieu MoyMar 7, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.