On Tue, Apr 23, 2013 at 8:25 PM, Junio C Hamano <gitster@xxxxxxxxx> wrote: > Yup. > > And then we would need to add the same option to existing callers of > "git commit" (such as "git rebase") to pass it down the callchain. Got it. > But stepping back a bit, I have a suspicion that your upstream > project _only_ cares about what you feed them (either by pushing > your work yourself to them, or telling them to pull from your > repository). There is no reason for you to be constantly signing > your commits you make during your exploratory development that you > may throw-away in the end. Your suspicions are correct. But I'm a bit paranoid, so it feels better to sign even local commits. > It _might_ be a better option to just teach "-S" option to "git > rebase" that tells it to replay all the commits with "commit -S", > instead of adding commit.gpgSign configuration. In my case, I don't do that much exploratory development locally, so I usually just commit, pull and push. Always signing everything can't really hurt, can it? Takes a few clock cycles more, and a few more bytes, but apart from that I don't see any problems? -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html