Jeff King <peff@xxxxxxxx> writes: > Yeah, it is a potential problem, but it just seems wrong to put too much > policy work onto the server. My take on it is somewhat different. The only thing in the end result we want to see is that the pushed commits are annotated with GPG signatures in the notes tree, and there is no reason for us to cast in stone that there has to be any significance in the commit history of the notes tree. In a busy hosting site that has many branches being pushed simultaneously, it is entirely plausible that the server side may just want to store each received push certificate in a new flat file in a filesystem, and have asynchronous process sweep the new certificates to update the notes tree, possibly creating a single notes tree commit that records updates by multiple pushes, for performance purposes, in its implementation of record_signed_push() in receive-pack. If you forced the clients to also prepare notes and push the notes tree to the server, you are forcing the ordering in the history of the notes, and closing the door for such a server implementation. I would consider it an unnecessary and/or premature policy decision. -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html