On 1 June 2012 07:52, Alexey Shvetsov <alexxy@g.o> wrote:
>>
>> What would git signing work with rebased commits? Would all of them
>> have to be signed once again?
>
>
> Commits itsels still will be signed
Do you know how git does this? Do you have experience/information you
can cite as to that this works?
Commit signing seems poorly documented at present, and I've been
looking at the git internals, and it would *APPEAR* that the content
that is signed is the blob of text you normally get when you
git cat-file -p $SHA1
And indeed, if you git cat-file -p $SHA1 > file, extract the
SIGNATURE part into its own file (removing the leading spaces), and
remove the "gnupg" section from the commit headers, gpg --verify
$sigfile $file # tells me I have a good signature.
Just I haven't worked out what happens when the SHA1 of the 'parent'
header changes, which *will* change if the rebase is anything other
than a fast-forward.
If that SHA1 changes, the gpg signature will surely fail?
--
Kent
perl -e "print substr( \"edrgmaM SPA NOcomil.ic\\@tfrken\", \$_ * 3,
3 ) for ( 9,8,0,7,1,6,5,4,3,2 );"
http://kent-fredric.fox.geek.nz
|
