Re:What does a PGP signature on a Git commit prove?
by lmm on Wednesday March 31, 2021 @08:49AM
(#26646572)
For a large project with multiple contributors I wouldn't want to sign the whole tree at a particular point in time (which seems like the natural interpretation of a signed tag) unless I'd actually reviewed it all personally (which, sure, maybe some maintainers do). The commit is the part that I made, so that's the part that I want to sign (and of course it contains a secure reference to a parent commit, but a reader would naturally understand that I'm not vouching for the whole repo history). And I'd far rather publish my contributions as commits on my branches (that then become a PR) than email patches around and worry about how to archive that, personally.
[ Parent
| on HN ]
Re:What does a PGP signature on a Git commit prove?
by rakoo on Wednesday March 31, 2021 @09:56AM
(#26647334)
The problem is that your signature is associated to the commit so it does make you vouch for history, and it lives on after your PR is merged. If you're doing a PR there's a chance that you are authenticated so that is what guarantees the changes do come from you and are not modified (your PR software should log all changes to the PR). Worst case your PR itself can be PGP-signed to say "I would like branch XXX currently at commit YYY be merged onto master currently at ZZZ" but I totally agree it would be a heavy process and signing commits does the job
Re:What does a PGP signature on a Git commit prove?
by lmm on Wednesday March 31, 2021 @10:29AM
(#26647769)
> The problem is that your signature is associated to the commit so it does make you vouch for history, and it lives on after your PR is merged.
That's exactly what I want though. I want anyone looking through history to be able to see that I signed that specific diff in that context (something weaker than the whole state of the tree at that point in time - but something stronger than the textual diff with no other context). The fact that rewriting history will break the signature is a feature not a bug, but I'd like the patch to carry my signature even after it's merged.