How can I sign each (even old) commit in the repository?

Question

Note that I am talking about GPG signing (-S) and not the "signoff" feature (-s)!

I have a git repository in which I would like to sign all my commits, even if they are really old commits. I am aware, that this will change the history, and that other people based on this repo will no longer be able to push their changes. This is not an issue for me, and I am fully aware of the implications.

I was thinking about a rebase -i command, but then I would lose all branch information and would flatten the whole history. Additionally, there are commits which are not by me, and I would like to keep those as-is.

Is there a way of doing this?

This makes no sense. It is not something you should do, or need to do, or is supported behaviour. Just sign the current commit. The entire point of signing is that, by signing a commit, you're signing all previous commits. Any given commit is by definition the sum of all previous commits. You sign off on one, you've implicitly signed off on every commit that is reachable from the one you've signed. — user229044
– user229044 ♦, Commented Nov 22, 2013 at 13:53
That's a very good point! And what you say makes perfect sense :) If you want, re-write it as an answer, and I will accept it as such! — exhuma
– exhuma, Commented Nov 22, 2013 at 14:00

Greg Bacon · Accepted Answer · 2013-11-22 16:40:50Z

You’re correct that rewriting published history will cause irritation for your collaborators.

For what you want to do, I recommend creating new signed tags. Say the SHA-1 of one of your commits is abc123. In that case, run

$ git tag -s abc123

See the git tag documentation for details.

Jean Waghetti · Accepted Answer · 2013-11-22 17:37:17Z

This will do the trick:

git filter-branch --commit-filter 'git commit-tree -S "$@"'

However, meagar's point is correct. Signing one commit is "philosophically" equivalent to signing all the previous commits.

exhuma · Accepted Answer · 2013-11-24 16:55:33Z

Well, after two days, @meagar still has not reformatted it as an answer, so here it is:

This makes no sense. It is not something you should do, or need to do, or is supported behaviour. Just sign the current commit. The entire point of signing is that, by signing a commit, you're signing all previous commits. Any given commit is by definition the sum of all previous commits. You sign off on one, you've implicitly signed off on every commit that is reachable from the one you've signed.

His comment makes perfect sense and answers my question! Having one signed commit in the graph, effectively puts a "stamp of approval" on that branch up to "beginning of time". Which is what I am really looking for. Signing each commit is unnecessary!

If you have more than one un-merged branch you could put a "signing" commit on each of them.

Collectives™ on Stack Overflow

How can I sign each (even old) commit in the repository?

3 Answers 3

Comments

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Related