# Re: Signed git-tag doesn't find default key 3 messages from 2006-10-21 to 2007-01-15. Participants: Horst H. von Brand, Andy Parkins. Thread: https://gitlist.dev/t/5977 ## Horst H. von Brand, 2006-10-21 00:52 Subject: Re: Signed git-tag doesn't find default key Message-ID: <200610210052.k9L0q88T005342@laptop13.inf.utfsm.cl> URL: https://gitlist.dev/e/200610210052.k9L0q88T005342%40laptop13.inf.utfsm.cl In-Reply-To: ``` Andy Parkins wrote: [...] > I'm going to advocate my change of only searching on the email address > for finding the key - there shouldn't be two keys with the same email > address anyway, so there shouldn't be a danger of ambiguity of key. There very well might be... say you have a key for signing git stuff, another one for emailing, another one for signing RPMs you create, ... I believe that is the idea of the GPG comment field, precisely. -- Dr. Horst H. von Brand User #22616 counter.li.org Departamento de Informatica Fono: +56 32 2654431 Universidad Tecnica Federico Santa Maria +56 32 2654239 Casilla 110-V, Valparaiso, Chile Fax: +56 32 2797513 ``` ## Andy Parkins, 2006-10-21 07:44 Subject: Re: Signed git-tag doesn't find default key Message-ID: <200610210844.46184.andyparkins@gmail.com> URL: https://gitlist.dev/e/200610210844.46184.andyparkins%40gmail.com In-Reply-To: <200610210052.k9L0q88T005342@laptop13.inf.utfsm.cl> ``` On Saturday 2006, October 21 01:52, Horst H. von Brand wrote: > There very well might be... say you have a key for signing git stuff, > another one for emailing, another one for signing RPMs you create, ... I > believe that is the idea of the GPG comment field, precisely. Either way, you're arguing for the fault being with Git - which has no notion of comment fields and so won't find the key anyway. Andy -- Dr Andrew Parkins, M Eng (Hons), AMIEE andyparkins@gmail.com ``` ## Horst H. von Brand, 2007-01-15 13:14 Subject: Re: Commit signing Message-ID: <200701151314.l0FDEohv008222@laptop13.inf.utfsm.cl> URL: https://gitlist.dev/e/200701151314.l0FDEohv008222%40laptop13.inf.utfsm.cl In-Reply-To: ``` Andy Parkins wrote: [...] > The answer is: no, you can't put your 100+X commits in my repository > because I don't trust the person who wrote X of them. It is paranoid, > and it is overkill, but it is also /my/ repository. It might also be > that you are my employee and you will do as you are damn well told. There is another angle to this: Currently, the "Signed-off-by:" lines give no reliable way of authenticating the origin of a patch, which is needed for traceability of authorship (for which they were introduced in the first place). -- Dr. Horst H. von Brand User #22616 counter.li.org Departamento de Informatica Fono: +56 32 2654431 Universidad Tecnica Federico Santa Maria +56 32 2654239 Casilla 110-V, Valparaiso, Chile Fax: +56 32 2797513 ```