`git replace`

Question

`git replace`

cgwalters opened this issue 9 years ago · comments

Colin Walters commented 9 years ago

How does git-evtag fit into this? Does libgit2 even know about them? Offhand it seems like we should ignore them.

Colin Walters · Answer 1 · Thu Aug 06 2015 06:44:14 GMT+0800 (China Standard Time)

See original #5

cmacq2 · Answer 2 · Tue Dec 22 2015 01:09:46 GMT+0800 (China Standard Time)

No ignoring it is not the right thing to do because it rewrites history. The point of signing a GIT commit is to authenticate history to future consumers so the fact that history was 'tampered with deliberately' needs to be preserved in the signature because it is possible to alter the exact semantics/content of the commit.

I think what you need is a way to find out if a commit was replaced, and then sign both the original and the replace commit and do this for each commit in the history that you sign.