From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Bottomley Subject: Re: [git patches] libata updates, GPG signed (but see admin notes) Date: Sun, 30 Oct 2011 14:05:01 +0400 Message-ID: <1319969101.5215.20.camel@dabdike> References: <20111026202235.GA20928@havoc.gtf.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Return-path: Received: from bedivere.hansenpartnership.com ([66.63.167.143]:60588 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755516Ab1J3KFG (ORCPT ); Sun, 30 Oct 2011 06:05:06 -0400 In-Reply-To: <20111026202235.GA20928@havoc.gtf.org> Sender: linux-ide-owner@vger.kernel.org List-Id: linux-ide@vger.kernel.org To: Jeff Garzik Cc: Andrew Morton , Linus Torvalds , linux-ide@vger.kernel.org, LKML On Wed, 2011-10-26 at 16:22 -0400, Jeff Garzik wrote: > 2) The GPG wrapping causes all '^-' lines to become '^- -'. This does NOT > reflect the true 'git diff' output, of course. > > For this reason, I am tempted to modify my new, GPG-signed pull request > template as follows, for subsequent pull requests: > > ------ > > pull req description > > "Please pull from $branch\n$url $branch" > > "Top of tree is $sha1_commit" > > ------ > > diffstat > diff > > That ensures that the critical part -- sha1 commit for top of tree -- > is GPG signed, while the diff will be outside the signed area and therefore > not mangled by wrapping. You can fix this by using mime and detached signatures as well but I wouldn't worry too much about it. What emerged at KS is that Linus uses gmail and gmail has no integration with pgp, thus pgp signing of pull requests is superfluous since Linus won't add the steps of saving the message to a text file and manually running pgp over it to verify because of the huge elongation in workflow this causes especially during a merge window. Ted Ts'o recommended using signed tags, but they're also a manual check. I think the ultimate consensus will be that we'll have to wait until git itself has pgp key handling built in (which the git people are looking at) before we move to using the web of trust in pull requests. James