Show HN: Graphite – Stacked Diffs on GitHub

Re:Show HN: Graphite – Stacked Diffs on GitHub by njaremko on Tuesday September 19, 2023 @11:59AM (#37571883)

I've been using this for a few months now, and it's been an absolute joy to use.

One thing that's been a bit annoying: my org enforces signed commits, and when you merge a stack, they sometimes rebase commits internally and lose the code signing, so you end up with an error to merge the rest of the stack.

Aside from that, working with stacks has been great!

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by Xiulung on Tuesday September 19, 2023 @12:43PM (#37572576)

Hey @njaremko,

Thank you for using Graphite and your support. This is something we're aware of and current thinking around.

Question, if we were to support this by signing commits: Would you want the commit to be signed by the Graphite GitHub App? Or would you prefer for it to be signed by Graphite on behalf of you? Or some other option that we haven't considered?

-Xiulung (UX @ Graphite)

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by njaremko on Tuesday September 19, 2023 @12:52PM (#37572717)

I think letting me give you a gpg private key and you sign commits with that would be ideal. I'm not sure how the app signing commits would work, since it needs to be signed by a member of our org I believe?

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by amtamt on Tuesday September 19, 2023 @12:55PM (#37572787)

then why not let them generate the key itself?

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by njaremko on Tuesday September 19, 2023 @01:16PM (#37573084)

So I can revoke the key if I need to (my understanding is that you need the private key for that)

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by Xiulung on Tuesday September 19, 2023 @02:20PM (#37573988)

Yep, our app signing the commits would mean requiring your org to approve the app as "someone" who can contribute to the repo

[ Parent | on HN ]

Re:Show HN: Graphite – Stacked Diffs on GitHub by joshka on Wednesday September 20, 2023 @03:38PM (#37589001)

Signed locally using your GPG key is the correct answer to this (IMO), otherwise you're replacing a one attestation with a much weaker one.

[ Parent | on HN ]