Re: [git patches] libata updates, GPG signed (but see admin notes)

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Wed, 2011-10-26 at 16:22 -0400, Jeff Garzik wrote:
> 2) The GPG wrapping causes all '^-' lines to become '^- -'.  This does NOT
>    reflect the true 'git diff' output, of course.
> 
>    For this reason, I am tempted to modify my new, GPG-signed pull request
>    template as follows, for subsequent pull requests:
> 
> 	---<begin GPG signed text>---
> 
>    	pull req description
> 
> 	"Please pull from $branch\n$url $branch"
> 
> 	"Top of tree is $sha1_commit"
> 
> 	---<end GPG signed text>---
> 
> 	diffstat
> 	diff
> 
>    That ensures that the critical part -- sha1 commit for top of tree --
>    is GPG signed, while the diff will be outside the signed area and therefore
>    not mangled by wrapping.

You can fix this by using mime and detached signatures as well but I
wouldn't worry too much about it.  What emerged at KS is that Linus uses
gmail and gmail has no integration with pgp, thus pgp signing of pull
requests is superfluous since Linus won't add the steps of saving the
message to a text file and manually running pgp over it to verify
because of the huge elongation in workflow this causes especially during
a merge window.

Ted Ts'o recommended using signed tags, but they're also a manual check.
I think the ultimate consensus will be that we'll have to wait until git
itself has pgp key handling built in (which the git people are looking
at) before we move to using the web of trust in pull requests.

James