On Sat, 2021-09-11 at 19:25 +0100, Pedro Falcato wrote: > Hi everyone, > > Yesterday, when pushing my first commits to edk2-platforms (as the > Ext4Pkg maintainer), I noticed that my commits (see 7872c98 and > 71f3343) stick out like a sore thumb, as I have GPG signing on my > commits on by default (see git config commit.gpgsign), globally > across all my projects.
They do? The gpgsig header is eaten by modern versions of git ... it only shows up as the verified decoration on github, which most people likely don't notice, because github has a huge amount of commit bling, so I'm not sure what you think people would notice. I suspect even ancient versions of git understand it's a header even if they can't parse it. > Is there an official stance on signed commits? I was thinking that > commit signing, at least for the maintainers that apply and push > patches, could be useful as a way to establish authenticity for every > commit that gets to the edk2 repos. The general consensus over at the Linux Kernel, which is an email based project like edk2, is that signed commits don't add anything useful. They can't be transmitted from the author in email, so they can only be added by the committer. In the current trust model, the committer is already trusted with access to the tree, so a signature doesn't add much beyond what's already known (the committer did this) and it can't add anything further about the authenticity of the actual commit if author != committer. The other problem with signed commits is there are lots of usual git operations (like rebase) where the signature doesn't survive. James -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80537): https://edk2.groups.io/g/devel/message/80537 Mute This Topic: https://groups.io/mt/85538324/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
