Re: [edk2-devel] Question about EDK2 and commit signing

["James Bottomley" <James.Bottomley@HansenPartnership.com>]

On Sat, 2021-09-11 at 19:25 +0100, Pedro Falcato wrote:
> Hi everyone,
> 
> Yesterday, when pushing my first commits to edk2-platforms (as the
> Ext4Pkg maintainer), I noticed that my commits (see 7872c98 and
> 71f3343) stick out like a sore thumb, as I have GPG signing on my
> commits on by default (see git config commit.gpgsign), globally
> across all my projects.

They do?  The gpgsig header is eaten by modern versions of git ... it
only shows up as the verified decoration on github, which most people
likely don't notice, because github has a huge amount of commit bling,
so I'm not sure what you think people would notice.  I suspect even
ancient versions of git understand it's a header even if they can't
parse it.

> Is there an official stance on signed commits? I was thinking that
> commit signing, at least for the maintainers that apply and push
> patches, could be useful as a way to establish authenticity for every
> commit that gets to the edk2 repos.

The general consensus over at the Linux Kernel, which is an email based
project like edk2, is that signed commits don't add anything useful. 
They can't be transmitted from the author in email, so they can only be
added by the committer.  In the current trust model, the committer is
already trusted with access to the tree, so a signature doesn't add
much beyond what's already known (the committer did this) and it can't
add anything further about the authenticity of the actual commit if
author != committer.  The other problem with signed commits is there
are lots of usual git operations (like rebase) where the signature
doesn't survive.

James