[LEDE-DEV] Proposal to sign all commits

[Daniel Dickinson]

On the signature agree

On 16-05-06 08:26 PM, David Lang wrote:
> On Fri, 6 May 2016, Daniel Dickinson wrote:
> 
> 
> This gets back to the question about what we are trying to achieve by
> signing the commits.
> 
> If the purpose is to track who put what into the central tree, then
> having the merge masters sign the merge commits is useful, and not an
> imposition on people submitting patches. We also recognize that this is
> all the signature represents.
> 
> If the purpose is to track back to the originator of the patch, that's a
> different, and much more difficult situation.

Agreed.

> 
>> I think even with a large group of merge master, if pull requests are
>> indeed planned as a means of making community participation easier, then
>> requiring commits is counter-productive.
> 
> I think you mean signed commits

Erm, yeah it'd be somewhat difficult to not require commits :-P

> 
>> In addition, it's not like pull requests should go directly into master
>> anyway, but rather should be merged into a staging tree and only pulled
>> into master once the person(s) responsible for giving the okay to the
>> pull request have deemed it acceptable.
>>
>> This goes back to something I've said in other message, where I have
>> suggested that it would be useful to have one or more
>> experimental/testing branches where pull requests and patches could be
>> more widely tested than an individual can do (in fact I'd argue that
>> ideally *everyone* goes through some level of testing from someone other
>> than themselves.
> 
> Ideally, but we need to recognize that we don't live in an ideal world :-)

True.  Getting as close as is reasonably feasible is a good goal though.
(Note all the weasel words...)

Regards,

Daniel