github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #543] Start signing commits with GPG? #379

New issue

Closed

opened 2026-05-05 05:43:55 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:43:55 -06:00

Owner

Originally created by @Fred-Barclay on GitHub (May 27, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/543

G'day @netblue30 ! :) Seeing as how you sign the releases on SourceForge with your gpg key, could you do the same for your commits here on GitHub? I build from the code here quite frequently as I want to make sure my commits and pull requests mesh well, and gpg-signed commits would help me trust the code I'm installing on my computer. I'm sure this would help several others as well.

It's not difficult to do, either. GitHub has put out a really good guide: https://github.com/blog/2144-gpg-signature-verification. After uploading your public key here, all you have to do is sign your commits with the -S flag: gpg commit -S -m "some random message"

Thanks!
Fred

Originally created by @Fred-Barclay on GitHub (May 27, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/543 G'day @netblue30 ! :) Seeing as how you sign the releases on SourceForge with your gpg key, could you do the same for your commits here on GitHub? I build from the code here quite frequently as I want to make sure my commits and pull requests mesh well, and gpg-signed commits would help me trust the code I'm installing on my computer. I'm sure this would help several others as well. It's not difficult to do, either. GitHub has put out a really good guide: https://github.com/blog/2144-gpg-signature-verification. After uploading your public key here, all you have to do is sign your commits with the -S flag: `gpg commit -S -m "some random message"` Thanks! Fred

gitea-mirror

2026-05-05 05:43:55 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:44:03 -06:00

Author

Owner

@reinerh commented on GitHub (May 28, 2016):

Just out of interest, do you verify them on your local checkout after you pulled or do you trust github's UI?

@reinerh commented on GitHub (May 28, 2016): Just out of interest, do you verify them on your local checkout after you pulled or do you trust github's UI?

gitea-mirror commented

2026-05-05 05:44:06 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (May 28, 2016):

I would definitely verify them locally.
It is nice that github's UI does show at a glance which commits were signed. But it's not worthy of trust, IMHO.

@Fred-Barclay commented on GitHub (May 28, 2016): I would definitely verify them locally. It is nice that github's UI does show at a glance which commits were signed. But it's not worthy of trust, IMHO.

gitea-mirror commented

2026-05-05 05:44:10 -06:00

Author

Owner

@requiredregistration commented on GitHub (Jun 11, 2016):

you should switch to a 4096-bit RSA key pair before that.

@requiredregistration commented on GitHub (Jun 11, 2016): you should switch to a 4096-bit RSA key pair before that.

gitea-mirror commented

2026-05-05 05:44:13 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jul 25, 2018):

Adding on to what @Fred-Barclay said, you can also do git config commit.gpgSign true so that you don't have to remember to put -S as an argument.

@chiraag-nataraj commented on GitHub (Jul 25, 2018): Adding on to what @Fred-Barclay said, you can also do `git config commit.gpgSign true` so that you don't have to remember to put `-S` as an argument.

gitea-mirror commented

2026-05-05 05:44:16 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Oct 3, 2018):

Seems like whoever wants to do this is already signing their commits, and it's been documented here (and elsewhere) as to how to do so if one wants to start doing it. I don't think there's any point in keeping this issue open at this point.

@chiraag-nataraj commented on GitHub (Oct 3, 2018): Seems like whoever wants to do this is already signing their commits, and it's been documented here (and elsewhere) as to how to do so if one wants to start doing it. I don't think there's any point in keeping this issue open at this point.

gitea-mirror referenced this issue

2026-05-05 05:47:06 -06:00

[GH-ISSUE #562] Can't launch LibreOffice with --net=none #399

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#379

No description provided.

Rows
Columns