{"type":"rich","version":"1.0","author_name":"npub16dt55fpq3a8r6zpphd9xngxr46zzqs75gna9cj5vf8pknyv2d7equx4wrd","author_url":"https://nostr.ae/npub16dt55fpq3a8r6zpphd9xngxr46zzqs75gna9cj5vf8pknyv2d7equx4wrd","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2014-05-21\n📝 Original message:On Wed, May 21, 2014 at 06:39:44PM +0200, Chris Beams wrote:\n\u003e I [was] searching for a way to enable signing by default [...]\n\u003e Unfortunately, there isn't one, meaning it's likely that most folks\n\u003e will forget to do this most of the time.\n\nFor all of my projects, I now I put this script in\n.git/hooks/post-commit and post-merge:\n\n    #!/bin/bash -eu\n\n    if ! git log -n1 --show-signature | grep -q 'gpg: Good signature'\n    then\n        yes \"FORGOT TO SIGN COMMIT MESSAGE\"\n        exit 1\n    fi\n\nSo anytime I forget to sign, I get an obvious error and can immediately\nrun git commit --amend -S.\n\nTo automatically add a script like the one above to all new projects (plus\nquickly add it old current projects), you can follow these instructions:\n\n    http://stackoverflow.com/questions/2293498/git-commit-hooks-global-settings\n\n\u003e If you're really serious about it, you should probably reject pull\n\u003e requests without signed commits; otherwise, signing becomes\n\u003e meaningless because only honest authors do it\n\nI find signing my commits quite useful even on projects without a\ndefault signing policy because it lets me diff from the last time I\nprovably reviewed the code.  Here's my script for that:\n\n    #!/bin/bash -eu\n\n    KEY=F29EC4B7\n\n    last_signed_commit=$( git log --topo-order --show-signature --pretty=oneline \\\n        | grep -m1 \" gpg: Signature made.*RSA key ID $KEY\" \\\n        | sed 's/ .*//' \\\n        | grep .\n    ) || { echo \"No signed commit found.  Dying...\" ; exit 1 ; }\n\n    set -x\n    git diff $last_signed_commit\n\nBy diffing against the last signed commit I made, I also review any\ncommits that were made using my name but which I didn't actually make,\nsuch as squashes and rebases of my commits (and, of course, forgeries).\n\nFor anyone who's bored and wants to read a lot of text, I think the\ndefinitive work on git signing is this:\n\n    http://mikegerwitz.com/papers/git-horror-story.html\n\n-Dave\n-- \nDavid A. Harding"}