On Wed, 2011-10-26 at 16:22 -0400, Jeff Garzik wrote: > 2) The GPG wrapping causes all '^-' lines to become '^- -'. This does NOT > reflect the true 'git diff' output, of course. > > For this reason, I am tempted to modify my new, GPG-signed pull request > template as follows, for subsequent pull requests: > > ---<begin GPG signed text>--- > > pull req description > > "Please pull from $branch\n$url $branch" > > "Top of tree is $sha1_commit" > > ---<end GPG signed text>--- > > diffstat > diff > > That ensures that the critical part -- sha1 commit for top of tree -- > is GPG signed, while the diff will be outside the signed area and therefore > not mangled by wrapping. You can fix this by using mime and detached signatures as well but I wouldn't worry too much about it. What emerged at KS is that Linus uses gmail and gmail has no integration with pgp, thus pgp signing of pull requests is superfluous since Linus won't add the steps of saving the message to a text file and manually running pgp over it to verify because of the huge elongation in workflow this causes especially during a merge window. Ted Ts'o recommended using signed tags, but they're also a manual check. I think the ultimate consensus will be that we'll have to wait until git itself has pgp key handling built in (which the git people are looking at) before we move to using the web of trust in pull requests. James -- To unsubscribe from this list: send the line "unsubscribe linux-ide" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
