On Sun, Sep 14, 2014 at 3:55 PM, hasufell <hasuf...@gentoo.org> wrote: > Davide Pesavento: >>> In any case, we would likely strip the history anyway to get a small >>> repo to work with. >>> >>> I have prepared a basic git update hook that keeps master clean >>> and attached it to the bug [1]. It enforces basic policies, prevents >>> forced updates and checks GPG signatures on left-most history line. It >>> can also be extended to do more extensive tree checks. >> >> Are we going to disallow merge commits and ask devs to rebase local >> changes in order to keep the history "clean"? >> > > I'd say it doesn't make sense to create merge commits for conflicts that > arise by someone having pushed earlier than you. > > Merge commits should only be there if they give useful information. >
I totally agree. But is there a way to automatically enforce this? > Also... if you merge from a _user_ who is untrusted and allow a > fast-forward merge, then the signature verification fails. That means > for such pull requests you either have to use "git am" or "git merge > --no-ff". > Right. In that case you can either sign the merge commit or amend the user's commit and sign it yourself (re-signing could be needed anyway if you have to rebase). Thanks, Davide
