Re: [gentoo-dev] Git Migration: launch plan & schedule (2015/Aug/08-09)

[Andrew Savchenko <bircoph@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]

On Fri, 3 Jul 2015 21:40:50 +0000 Robin H. Johnson wrote:
> On Sat, Jul 04, 2015 at 12:19:41AM +0300, Andrew Savchenko wrote:
> > As I see from git docs only commits and tags may be signed. There
> > is no way to sign a push. Moreover there is no need to sign each
> > commit, see what Linux says on that:
> > http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html
> That was Linus's 2009 opinion, and he changed his mind since then, with
> the research into further attacks on SHA1.
> 
> Git (since 2.2) DOES support signed push. Look at the manpage for
> git-push, for the --signed option:
> http://git-scm.com/docs/git-push

We have a rule of "one year compatibility period". ChangeLog shows
that git-2.2.0 was introduced on 02 Dec 2014. So pushed commits
can't be enforced before 02 Dec 2015. (And yes, my laptop
still uses an older version, that's why I was unable to find --sign
in the git-push manual.)
 
Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]