[PATCH 0/1] Update Git to 2.9.0

[PATCH 0/1] Update Git to 2.9.0

[Leo Famulari]

Git 2.9.0 has been released [0].

There is one notable change for us, commit 66948561 (commit-tree: do not
pay attention to commit.gpgsign) [1].

Apparently, it was never intended for the repo option commit.gpgSign to
apply to low-level "plumbing" commit operations such as those invoked by
`stash`, `rebase`, `filter-branch`, etc.

So, `git stash` no longer invokes GPG.

The commit text seems to imply that `git rebase` would no longer re-sign
commits, but that's not the case from my tests.

I didn't test any other commands.

[0]
https://git.kernel.org/cgit/git/git.git/tag/?h=v2.9.0

[1]
https://git.kernel.org/cgit/git/git.git/commit/?id=66948561

Leo Famulari (1):
  gnu: git: Update to 2.9.0

 gnu/packages/version-control.scm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.8.4

[PATCH 1/1] gnu: git: Update to 2.9.0

[Leo Famulari]

* gnu/packages/version-control.scm (git): Update to 2.9.0.
(git-manpages)[source]: Update hash.
---
 gnu/packages/version-control.scm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 801bd29..2b2076c 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -112,14 +112,14 @@ as well as the classic centralized workflow.")
   ;; Keep in sync with 'git-manpages'!
   (package
    (name "git")
-   (version "2.8.4")
+   (version "2.9.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://kernel.org/software/scm/git/git-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0mqnzs4wz2x1fa6kq2ckgf42fgx6qwp64ra1lgg73245l4r9l3hj"))))
+              "02dl8yvvl7m4zy39s0xmqr958ah7krvkv94lmx4vz3wl95wsj7zl"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("native-perl" ,perl)
@@ -292,7 +292,7 @@ everything from small to very large projects with speed and efficiency.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "1xdpp1i8sgdzk708vnxrm1z6dg4mip12fswihb8hlg2v5qqgrpfj"))))
+                "0ic4zs4axkkwa44nqv5iihj3q2nm42kx0j8scnfp1z93m6pw31fw"))))
     (build-system trivial-build-system)
     (arguments
      '(#:modules ((guix build utils))
-- 
2.8.4

Re: [PATCH 0/1] Update Git to 2.9.0

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> Git 2.9.0 has been released [0].
>
> There is one notable change for us, commit 66948561 (commit-tree: do not
> pay attention to commit.gpgsign) [1].
>
> Apparently, it was never intended for the repo option commit.gpgSign to
> apply to low-level "plumbing" commit operations such as those invoked by
> `stash`, `rebase`, `filter-branch`, etc.
>
> So, `git stash` no longer invokes GPG.

Sounds reasonable; ‘git commit’ still honors ‘commit.gpgsign’, right?

> The commit text seems to imply that `git rebase` would no longer re-sign
> commits, but that's not the case from my tests.

OK.  It would be bad if ‘git rebase’ would silently discard signatures.
Thanks for paying attention to this!

Otherwise the updates LGTM!

Thank you,
Ludo’.

Re: [PATCH 0/1] Update Git to 2.9.0

[Leo Famulari]

On Sun, Jun 19, 2016 at 04:01:25PM +0200, Ludovic Courtès wrote:
> Sounds reasonable; ‘git commit’ still honors ‘commit.gpgsign’, right?

Yes, that still works as expected, at least in the simple case.

> > The commit text seems to imply that `git rebase` would no longer re-sign
> > commits, but that's not the case from my tests.
> 
> OK.  It would be bad if ‘git rebase’ would silently discard signatures.
> Thanks for paying attention to this!

I'm not sure what you mean exactly. If you rebase some signed commits,
the commits whose history changes will lose their signatures, because
they are no longer the same commits. But, I noticed this with previous
versions of Git also.

Because we never rewrite history once it's been on Savannah's master
branch, the only commits that need to be re-signed after rebase are my
own commits, so far seen only on my local repo. I've never needed to
rebase others' commits, so their signatures are unaffected.

Does that make sense?

Re: [PATCH 0/1] Update Git to 2.9.0

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> On Sun, Jun 19, 2016 at 04:01:25PM +0200, Ludovic Courtès wrote:

[...]

>> OK.  It would be bad if ‘git rebase’ would silently discard signatures.
>> Thanks for paying attention to this!
>
> I'm not sure what you mean exactly. If you rebase some signed commits,
> the commits whose history changes will lose their signatures, because
> they are no longer the same commits. But, I noticed this with previous
> versions of Git also.
>
> Because we never rewrite history once it's been on Savannah's master
> branch, the only commits that need to be re-signed after rebase are my
> own commits, so far seen only on my local repo. I've never needed to
> rebase others' commits, so their signatures are unaffected.
>
> Does that make sense?

It does!  I was referring to rebasing my own commits, indeed; currently
‘git rebase’ re-signs them, and I was just hoping this hadn’t changed,
and AIUI it hasn’t changed.

Thanks for clarifying!

Ludo’.