On Tue, Apr 12, 2016 at 07:15:34PM -0400, David Turner wrote: > It would be possible, of course, to GPG-sign the entire commit's > transitive data (rather than just the SHA1s of same). But as far as I > know, that is not ever what is done. There is a project called git-evtag which does this, and you can find mention on the list. The problem is just that it's not very efficient. That's maybe OK for tag-signing, which is relatively rare. It wouldn't really work for commit-signing. -Peff -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html