📅 Original date posted:2014-05-21
📝 Original message:Hi Wladimir,
I'm personally happy to comply with this for any future commits, but wonder if you've considered the arguments against commit signing [1]? Note especially the reference therein to Linus' original negative opinion on signed commits [2].
I came across these when searching for a way to enable signing by default, e.g. a `git config` option that might allow for this. Unfortunately, there isn't one, meaning it's likely that most folks will forget to do this most of the time.
If you're really serious about it, you should probably reject pull requests without signed commits; otherwise, signing becomes meaningless because only honest authors do it, and forgetful or malicious ones can avoid it without penalty.
That said, I'm not sure that creating such a barrier to contribution is worth it.
- Chris
[1]: http://stackoverflow.com/a/10166916/622403
[2]: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html
On May 21, 2014, at 2:23 PM, Wladimir <laanwj at gmail.com> wrote:
> Hello all,
>
> When you're contributing to Bitcoin Core development please sign your
> git commits. This is easy to do and will help in assuring the
> integrity of the tree.
>
> How to sign your commits?
> ------------------------------------------
>
> Provide the `-S` flag (or `--gpg-sign`) to git commit when you commit
> your changes, for example
>
> git commit -m "Commit message" -S
>
> Optionally you can provide a key id after the -S option to sign with a
> specific key.
>
> What if I forgot?
> -------------------------
>
> You can retroactively sign your previous commit using --amend, for example
>
> git commit -S --amend
>
> If you need to go further back, you can use the interactive rebase
> command with 'edit'. Replace HEAD~3 with the base commit from which
> you want to start.
>
> git rebase -i HEAD~3
>
> Replace 'pick' by 'edit' for the commit that you want to sign and the
> rebasing will stop after that commit. Then you can amend the commit as
> above. Afterwards, do
>
> git rebase --continue
>
> As this will rewrite history, you cannot do this when your commit is
> already merged. In that case, too bad, better luck next time.
>
> If you rewrite history for another reason - for example when squashing
> commits - make sure that you re-sign as the signatures will be lost.
>
> How to check if commits are signed?
> -------------------------------------------------------
>
> Use git log with show-signature,
>
> git log --show-signature
>
> commit 6fcdad787f1fb381a3a0fe6b1a1e45477426dccb
> gpg: Signature made Wed 21 May 2014 12:27:55 PM CEST using RSA key
> ID 2346C9A6
> gpg: Good signature from "Wladimir J. van der Laan <laanwj at gmail.com>"
> Author: Wladimir J. van der Laan <laanwj at gmail.com>
> Date: Wed May 21 12:27:37 2014 +0200
>
> qt: Periodic language update
> ...
>
> You can also pass the --show-signature option to `git show` to check a
> single commit.
>
> If you do this on the current repository you'll see that I'm almost
> the only person signing commits. I would like more people to get into
> this habit.
>
> How to sign merges?
> --------------------------------
>
> When using the github interface to merge a pull request, the resulting
> merge commit is not signed.
>
> Pieter Wullie wrote a script that simplifies merging and signing. It
> can be found in contrib/devtools. Setup instructions can be found in
> the README.md in that directory. After setting it up for the
> repository you can use the script in the following way:
>
> contrib/devtools/github-merge.sh 1234
>
> Replace 1234 by the pull request number that you want to merge. It
> will merge the pull request and drop you into a shell so you can
> verify changes and test. Once satisfied, exit the shell and answer the
> questions to merge and sign it and push upstream automatically (or
> not).
>
> Please use this script when possible for merging instead of the github
> interface.
>
> --------------------------
>
> Wladimir
>
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing platform available
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140521/39a9fcfc/attachment.html>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140521/39a9fcfc/attachment.sig>;
Chris Beams [ARCHIVE] /
npub1vl…69gsv
2023-06-07 15:21:53
in reply to nevent1q…fc23
Author Public Key
npub1vlgx34nzzqzrqq0uujch65yyzyknuduuqulj24ydlnarhwdhwzlsx69gsvPublished at
2023-06-07 15:21:53Event JSON
{
"id": "9f20853f209ebcc543001a740429c53cd134d3c7495eb47ff2adc3cbf01b710c",
"pubkey": "67d068d66210043001fce4b17d5084112d3e379c073f25548dfcfa3bb9b770bf",
"created_at": 1686151313,
"kind": 1,
"tags": [
[
"e",
"6ed0060b87c02af20d6af6fded563264095ae2a36fee168b566cb3b0da703edb",
"",
"root"
],
[
"e",
"0488b008c1cab6a05b7c476048ce185686b90cc1df09df331cbc855c9ca52cd7",
"",
"reply"
],
[
"p",
"30217b018a47b99ed4c20399b44b02f70ec4f58ed77a2814a563fa28322ef722"
]
],
"content": "📅 Original date posted:2014-05-21\n📝 Original message:Hi Wladimir,\n\nI'm personally happy to comply with this for any future commits, but wonder if you've considered the arguments against commit signing [1]? Note especially the reference therein to Linus' original negative opinion on signed commits [2].\n\nI came across these when searching for a way to enable signing by default, e.g. a `git config` option that might allow for this. Unfortunately, there isn't one, meaning it's likely that most folks will forget to do this most of the time.\n\nIf you're really serious about it, you should probably reject pull requests without signed commits; otherwise, signing becomes meaningless because only honest authors do it, and forgetful or malicious ones can avoid it without penalty.\n\nThat said, I'm not sure that creating such a barrier to contribution is worth it.\n\n- Chris\n\n[1]: http://stackoverflow.com/a/10166916/622403\n[2]: http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html\n\nOn May 21, 2014, at 2:23 PM, Wladimir \u003claanwj at gmail.com\u003e wrote:\n\n\u003e Hello all,\n\u003e \n\u003e When you're contributing to Bitcoin Core development please sign your\n\u003e git commits. This is easy to do and will help in assuring the\n\u003e integrity of the tree.\n\u003e \n\u003e How to sign your commits?\n\u003e ------------------------------------------\n\u003e \n\u003e Provide the `-S` flag (or `--gpg-sign`) to git commit when you commit\n\u003e your changes, for example\n\u003e \n\u003e git commit -m \"Commit message\" -S\n\u003e \n\u003e Optionally you can provide a key id after the -S option to sign with a\n\u003e specific key.\n\u003e \n\u003e What if I forgot?\n\u003e -------------------------\n\u003e \n\u003e You can retroactively sign your previous commit using --amend, for example\n\u003e \n\u003e git commit -S --amend\n\u003e \n\u003e If you need to go further back, you can use the interactive rebase\n\u003e command with 'edit'. Replace HEAD~3 with the base commit from which\n\u003e you want to start.\n\u003e \n\u003e git rebase -i HEAD~3\n\u003e \n\u003e Replace 'pick' by 'edit' for the commit that you want to sign and the\n\u003e rebasing will stop after that commit. Then you can amend the commit as\n\u003e above. Afterwards, do\n\u003e \n\u003e git rebase --continue\n\u003e \n\u003e As this will rewrite history, you cannot do this when your commit is\n\u003e already merged. In that case, too bad, better luck next time.\n\u003e \n\u003e If you rewrite history for another reason - for example when squashing\n\u003e commits - make sure that you re-sign as the signatures will be lost.\n\u003e \n\u003e How to check if commits are signed?\n\u003e -------------------------------------------------------\n\u003e \n\u003e Use git log with show-signature,\n\u003e \n\u003e git log --show-signature\n\u003e \n\u003e commit 6fcdad787f1fb381a3a0fe6b1a1e45477426dccb\n\u003e gpg: Signature made Wed 21 May 2014 12:27:55 PM CEST using RSA key\n\u003e ID 2346C9A6\n\u003e gpg: Good signature from \"Wladimir J. van der Laan \u003claanwj at gmail.com\u003e\"\n\u003e Author: Wladimir J. van der Laan \u003claanwj at gmail.com\u003e\n\u003e Date: Wed May 21 12:27:37 2014 +0200\n\u003e \n\u003e qt: Periodic language update\n\u003e ...\n\u003e \n\u003e You can also pass the --show-signature option to `git show` to check a\n\u003e single commit.\n\u003e \n\u003e If you do this on the current repository you'll see that I'm almost\n\u003e the only person signing commits. I would like more people to get into\n\u003e this habit.\n\u003e \n\u003e How to sign merges?\n\u003e --------------------------------\n\u003e \n\u003e When using the github interface to merge a pull request, the resulting\n\u003e merge commit is not signed.\n\u003e \n\u003e Pieter Wullie wrote a script that simplifies merging and signing. It\n\u003e can be found in contrib/devtools. Setup instructions can be found in\n\u003e the README.md in that directory. After setting it up for the\n\u003e repository you can use the script in the following way:\n\u003e \n\u003e contrib/devtools/github-merge.sh 1234\n\u003e \n\u003e Replace 1234 by the pull request number that you want to merge. It\n\u003e will merge the pull request and drop you into a shell so you can\n\u003e verify changes and test. Once satisfied, exit the shell and answer the\n\u003e questions to merge and sign it and push upstream automatically (or\n\u003e not).\n\u003e \n\u003e Please use this script when possible for merging instead of the github\n\u003e interface.\n\u003e \n\u003e --------------------------\n\u003e \n\u003e Wladimir\n\u003e \n\u003e ------------------------------------------------------------------------------\n\u003e \"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE\n\u003e Instantly run your Selenium tests across 300+ browser/OS combos.\n\u003e Get unparalleled scalability from the best Selenium testing platform available\n\u003e Simple to use. Nothing to install. Get started now for free.\"\n\u003e http://p.sf.net/sfu/SauceLabs\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140521/39a9fcfc/attachment.html\u003e\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 842 bytes\nDesc: Message signed with OpenPGP using GPGMail\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140521/39a9fcfc/attachment.sig\u003e",
"sig": "b96c5ceaa96ae40e96ac962bdfdfbca07591ca7700096727b76f7502d91c6287c576ddd2f29ff152023d0d80ff2bf0bd6a10e95dac8dc7fbeb1f3a09c3eed33a"
}