From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: =?utf-8?B?4oCYY29yZS11cGRhdGVz?= =?utf-8?B?4oCZ?= merge is a squashed commit Date: Fri, 5 Aug 2016 13:11:15 -0400 Message-ID: <20160805171115.GB20835@jasmine> References: <87a8gtyntw.fsf@netris.org> <20160804082400.GA1638@solar> <87ziosyalv.fsf@netris.org> <87a8gso9p4.fsf@igalia.com> <20160804164453.GB8137@jasmine> <87a8gsmq2h.fsf@igalia.com> <20160804200519.GA14007@jasmine> <874m6zmzvk.fsf@igalia.com> <20160805145943.GA16973@jasmine> <87invfjh2h.fsf@igalia.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:52358) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVieg-0000Xm-O8 for guix-devel@gnu.org; Fri, 05 Aug 2016 13:11:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bViec-0005mq-JR for guix-devel@gnu.org; Fri, 05 Aug 2016 13:11:30 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:42081) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVieb-0005l3-6j for guix-devel@gnu.org; Fri, 05 Aug 2016 13:11:26 -0400 Content-Disposition: inline In-Reply-To: <87invfjh2h.fsf@igalia.com> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Andy Wingo Cc: guix-devel@gnu.org On Fri, Aug 05, 2016 at 06:50:30PM +0200, Andy Wingo wrote: > Why would you sign a commit if you don't attest to intermediate unsigned > commits? If I push A-B-C with a signed HEAD immediately after somebody pushes a forged D, won't it look like I vouch for D? How could a 3rd party tell whether D was pushed by me or somebody else? Does your suggested method address this hypothetical situation?