git-wotr / spec

Securely review git commits
Other
3 stars 3 forks source link

Add readme #11

Closed Ekleog closed 6 years ago

Ekleog commented 6 years ago

Obvious PR

oxij commented 6 years ago

A funny side-effect of the current settings: how can you both have all commits (including merge commits) signed and all commits go via PR at the same time?

Ekleog commented 6 years ago

Yeah, I agree… with your initial PR I rebased your commit by hand and it looks like github let me do the push, but I'm not sure whether that's because I'm an owner of the organization or not. Theoretically github has this rebase option that should be a no-op if the commit was already on master, but when I tried to use it on your PR it answered with an internal error…

Anyway, we will be able to git-wotr-sign all commits after the fact once the spec will be complete with implementations, so I guess commit signing with built-in git isn't that important right now :) (and, well, actually we'll also be able to just each add a signed tag at the v1 of the RFC, as we don't really need verification of the whole history here)