threads / discuss / 5977

Re: Signed git-tag doesn't find default key

Subject: Re: Signed git-tag doesn't find default key

## tl;dr

3 messages between Oct 21, 2006 and Jan 15, 2007.

replies: 2people: 2as markdown or json

Horst H. von Brand· Oct 21, 2006, 00:52 UTC · lore

Andy Parkins <andyparkins@gmail.com> wrote:

[...]

> I'm going to advocate my change of only searching on the email address
> for finding the key - there shouldn't be two keys with the same email
> address anyway, so there shouldn't be a danger of ambiguity of key.

There very well might be... say you have a key for signing git stuff, another one for emailing, another one for signing RPMs you create, ... I believe that is the idea of the GPG comment field, precisely.

-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                    Fono: +56 32 2654431
Universidad Tecnica Federico Santa Maria             +56 32 2654239
Casilla 110-V, Valparaiso, Chile               Fax:  +56 32 2797513

Andy Parkins· Oct 21, 2006, 07:44 UTC · re: Horst H. von Brand · lore

On Saturday 2006, October 21 01:52, Horst H. von Brand wrote:

> There very well might be... say you have a key for signing git stuff,
> another one for emailing, another one for signing RPMs you create, ... I
> believe that is the idea of the GPG comment field, precisely.

Either way, you're arguing for the fault being with Git - which has no notion of comment fields and so won't find the key anyway.

Andy

-- 
Dr Andrew Parkins, M Eng (Hons), AMIEE
andyparkins@gmail.com

Horst H. von Brand· Jan 15, 2007, 13:14 UTC · lore

Re: Commit signing

Andy Parkins <andyparkins@gmail.com> wrote:

[...]

> The answer is: no, you can't put your 100+X commits in my repository
> because I don't trust the person who wrote X of them.  It is paranoid,
> and it is overkill, but it is also /my/ repository.  It might also be
> that you are my employee and you will do as you are damn well told.

There is another angle to this: Currently, the "Signed-off-by:" lines give no reliable way of authenticating the origin of a patch, which is needed for traceability of authorship (for which they were introduced in the first place).

-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                    Fono: +56 32 2654431
Universidad Tecnica Federico Santa Maria             +56 32 2654239
Casilla 110-V, Valparaiso, Chile               Fax:  +56 32 2797513