Re: [PATCH v5 0/6] fast-export, fast-import: add support for signed-commits

[Patrick Steinhardt <ps@pks.im>]

On Mon, Feb 24, 2025 at 11:35:00PM -0800, Elijah Newren wrote:
> On Mon, Feb 24, 2025 at 9:01 AM Junio C Hamano <gitster@pobox.com> wrote:
> >
> > Christian Couder <christian.couder@gmail.com> writes:
> >
> > > Luke Shumaker sent the first 4 versions of this series in April 2021,
> > > but it looks like he stopped before it got merged. Let's finish
> > > polishing it.
> >
> > Nice to see an old topic resurrected.
> >
> > > fast-export has an existing --signed-tags= option that controls how to
> > > handle tag signatures.  However, there is no equivalent for commit
> > > signatures; it just silently strips the signature out of the commit
> > > (analogously to --signed-tags=strip).
> > >
> > > So implement a --signed-commits= flag in fast-export, and implement
> > > the receiving side of it in fast-import.
> >
> > Nice.
> >
> > I haven't thought about this topic obviously for a looooong time,
> > but I wonder we may want to have an option, which is independent
> > from these --signed-tags/--signed-commits options addressed here,
> > that allows the person who performed the import to attest to the
> > result by adding their own signature on tags and commits, whether
> > these tags and commits were originally signed or not.
> 
> For what it's worth, this has been requested multiple times of
> git-filter-repo, so there is some desire for this feature.

This is also exactly the usecase we have been reviving this effort for
:) We recently hit such a case where a customer was basically unable to
use git-filter-repo(1) due to commit signatures, so we wanted to help
out and get this patch series landed so that the issue can ultimately be
addressed in git-filter-repo(1).

Patrick