3 ms·
The problem is that your signature is associated to the commit so it does make you vouch for history, and it lives on after your PR is merged. If you're doing a
by rakoo 6y ago
The problem is that your signature is associated to the commit so it does make you vouch for history, and it lives on after your PR is merged. If you're doing a PR there's a chance that you are authenticated so that is what guarantees the changes do come from you and are not modified (your PR software should log all changes to the PR). Worst case your PR itself can be PGP-signed to say "I would like branch XXX currently at commit YYY be merged onto master currently at ZZZ" but I totally agree it would be a heavy process and signing commits does the job
- lmm 6y ago> The problem is that your signature is associated to the commit so it does make you vouch for history, and it lives on after your PR is merged. That's exactly what I want though. I want anyone looking through history to be able to see that I signed that specific diff in that context (something weaker than the whole state of the tree at that point in time - but something stronger than the textual diff with no other context). The fact that rewriting history will break the signature is a feature not a bug, but I'd like the patch to carry my signature even after it's merged.