On 1 June 2012 07:52, Alexey Shvetsov <ale...@gentoo.org> wrote: >> >> What would git signing work with rebased commits? Would all of them >> have to be signed once again? > > > Commits itsels still will be signed
Do you know how git does this? Do you have experience/information you can cite as to that this works? Commit signing seems poorly documented at present, and I've been looking at the git internals, and it would *APPEAR* that the content that is signed is the blob of text you normally get when you git cat-file -p $SHA1 And indeed, if you git cat-file -p $SHA1 > file, extract the SIGNATURE part into its own file (removing the leading spaces), and remove the "gnupg" section from the commit headers, gpg --verify $sigfile $file # tells me I have a good signature. Just I haven't worked out what happens when the SHA1 of the 'parent' header changes, which *will* change if the rebase is anything other than a fast-forward. If that SHA1 changes, the gpg signature will surely fail? -- Kent perl -e "print substr( \"edrgmaM SPA NOcomil.ic\\@tfrken\", \$_ * 3, 3 ) for ( 9,8,0,7,1,6,5,4,3,2 );" http://kent-fredric.fox.geek.nz
