Hello! I’ve moved away from the PR/MR git workflow to the email one and I’ve been delighted by it. However, there is one thing that feels a bit like a regression to me. On the PR/MR workflow, if someone wants to contribute to my project, they can simply make a couple of commits and open a “Pull Request” or “Merge Request.” Once reviewed, I can decide to merge via several options: * Creating a merge commit. * Rebasing their commits. * Asking the UI of the (centralized) system (GitHub, GitLab, etc.) to do Whatever is decided, the commits end up in my repository and the author might have signed the commits and their signature is still there. With the email workflow, from what I understand, `git am` has no way to keep the signature of the author — and I have not found anything going that direction with `git send-email` and `git format-patch`, and I think that the reason why is because the commit is modified to introduce the committer (committer being me here; the author being the contributor who sent the patch), whence the commit SHA changes. The author signature is simply dropped, and `git log --show-signature` only shows my GPG signature; not the author’s anymore! So… I was wondering: since we can only sign commits, is there any way / work in progress to attach the author signature to a commit? To me, it would make sense to have something hierarchical: the comitter simply signs above what the author signed, and the author doesn’t sign the whole commit (I guess?), since we want to be able to change the commit hash. What do you think? Cheers, Dimitri
Attachment:
signature.asc
Description: PGP signature
