Supporting Signed Commits with rebase merges

[vbjay]

Select Topic Area

Question

Body

I reference gitextensions/gitextensions#10439 to start off with.

I would like to start a discussion on how to achieve the following:

• Flat history( no merge commits but ff only)
• If pr contributor signed commits that their signature remains intact or github somehow re-signs with a user provided private key that they provide github.

I understand the lack of trust of me giving github a private key saying it is me. How do I know the key was not exposed to an employee/hacker...or whatnot. I don't. So the trust of such a vbjay github private key would be less trusted than one I manage on my own.

---

• Yes. I have read the docs.
• Yes. I understand how a rebase merge works
• Yes. I understand the difficulty of the parts of combining the different requirements.

[airtower-luna]

The only way to have both of the points you want is to do the ff-merge yourself (locally or via Actions) and push. Would be nice if GitHub extended the PR UI to support ff-merge.

[vbjay]

@airtower-luna Yes. I knew about that possibility of doing the local merge but it raises a couple of issues.

• Say a maintainer is merging multiple pull requests. Once they have merged one the next ff merge will fail unless the other pr's creator rebases on their own. With our builds taking a while, it takes time for the rebase and be ready to merge to be good with the checks till the maintainer can merge.
• Even with an action the ff merge would again fail if 2 prs are wanting to ff merge till 2nd is rebased.

One thought. Is having partial merge. Someone like @mstv or @RussKie approves my pull request. So he sets it up to autocomplete with rebase merge. But I have marked my pull request as needing my signature. So it sends me a notification and I do something to cause the github commits to be signed with whatever I provide at the time. The trust issue still exists.

It's a tough one. I know the idea of doing a signed tag after to sign unsigned commits but that is me signing all commits and really in that case I would want to create a merge commit that is signed to say i am signing these commits comming in and not all commits in the flat history.. Along with non maintainers can't create tags in a repo. So I see the issues.

[vbjay]

Maybe a ssh push of some sort to sign with my original key but the ssh comms adds info and so it does a session tie in to add to the signature or ... So basically it is the trust of my ssh public key on github and some kind of nonce with my gpgkey and ssh to finalize the pr.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬