On Wed, 11 May 2016 02:18:03 +1200 Kent Fredric <kentfred...@gmail.com> wrote:
> On 11 May 2016 at 00:04, Alexis Ballier <aball...@gentoo.org> wrote: > > well, then I can commit crap with --author m...@gentoo.org and claim > > he made me rebase it :) > > > Well, if you're going down that line ... > > You don't rebase it, you just merge it, than then mrp claims obama > forced his hand to write the commit at gunpoint and sign it, and > that's why he is both --author and --committer > > That's obviously silly talk :D yes, and it was meant to be :) my point was more that if we want signed commits, then better have author sign it, and thus use merge if we just want committer signature, then I don't really see the point in signing: it isnt more secure than pecker access + ldap password, and infra could simply sign public git trees with a unique gentoo key [...]
