Page MenuHomeFreeBSD
Files F166257739

D29726.id87313.diff
No OneTemporary
Actions

D29726.id87313.diff
View Options

diff --git a/documentation/content/en/articles/committers-guide/_index.adoc b/documentation/content/en/articles/committers-guide/_index.adoc
--- a/documentation/content/en/articles/committers-guide/_index.adoc
+++ b/documentation/content/en/articles/committers-guide/_index.adoc
@@ -2110,6 +2110,49 @@
At this point your work is now in your branch on +GitHub+ and you can
share the link with other collaborators.
+[[git-gpg-signing]]
+=== Signing the commits, tags, and pushes, with GnuPG
+
+Git knows how to sign commits, tags, and pushes.
+
+When you sign a Git commit or a tag, you can prove that the code you submitted came from you and wasn't altered while you were transferring it.
+You also can prove that you submitted the code and not someone else.
+
+To sign one commit, you can simply use `git commit -s -S KEY-ID`.
+You can verify the signature of a commit with `git verify-commit <commit hash>`, or with `git log --show-signature`.
+To sign a tag, you can use `git tag -s -u KEY-ID <tag name>`, and to verify the signature, `git tag -v <tag name>`.
+
+
+
+While signed tags and commits assert that the objects thusly signed came from you, who signed these objects, there is not a good way to assert that you wanted to have a particular object at the tip of a particular branch.
+My signing v2.0.1 tag only means I want to call the version v2.0.1, and it does not mean I want to push it out to my 'master' branch -- it is likely that I only want it in 'maint', so the signature on the object alone is insufficient.
+The only assurance to you that 'maint' points at what I wanted to place there comes from your trust on the hosting site and my authentication with it, which cannot easily audited later.
+
+To sign a push, use: `git push --signed`.
+
+Doing it this way can get tedious very fast though.
+The best way is to simply tell Git you always want to sign commits, tags, and pushes.
+You can do this by setting a few configuration variables:
+
+[source,shell]
+....
+% git config --global --add user.signingKey=LONG-KEY-ID
+% git config --global --add commit.gpgSign=true
+% git config --global --add tag.gpgSign=true
+% git config --global --add push.gpgSign=if-asked
+....
+
+[NOTE]
+======
+To avoid possible collisions, make sure you give a long key id to Git.
+You can get the long id with: `gpg --list-secret-keys --keyid-format LONG`.
+======
+
+[TIP]
+======
+To use specific subkeys, and not have GnuPG to resolve the subkey to a primary key, attach `!` to the key.
+For example, to encrypt for the subkey `DEADBEEF`, use `DEADBEEF!`.
+======
[[vcs-history]]
== Version Control History

File Metadata

Mime Type
text/plain
Expires
Thu, Aug 13, 2:26 PM (7 h, 20 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
36649472
Default Alt Text
D29726.id87313.diff (2 KB)

Event Timeline