[LEDE-DEV] Proposal to sign all commits

[Daniel Dickinson]

Hi David,

One thing your suggestion does though, is mean that the initial commits
are not created on the master branch (for which there are few
committers), so the idea that signing all commits shouldn't be an issue
because there are only a few special souls who create commits is not
actually the case, and in fact most commits (except the merges) will be
created by someone other than the merge masters.

I think if this suggestion (or fast-forward only) is taken, then the
requiring signing is more problematic because there will be a much wider
group of people signing (everything except merge commits).

I think even with a large group of merge master, if pull requests are
indeed planned as a means of making community participation easier, then
requiring commits is counter-productive.

In addition, it's not like pull requests should go directly into master
anyway, but rather should be merged into a staging tree and only pulled
into master once the person(s) responsible for giving the okay to the
pull request have deemed it acceptable.

This goes back to something I've said in other message, where I have
suggested that it would be useful to have one or more
experimental/testing branches where pull requests and patches could be
more widely tested than an individual can do (in fact I'd argue that
ideally *everyone* goes through some level of testing from someone other
than themselves.

Regards,

Daniel