Often we sign off patches/merge requests for security. Would it be possible to show this information? Something like this:
Related to #885
Where do you see a sign-off in this screenshot?
It's got randomuser's avatar (committer) and then a smaller one for me (I signed off). The commit message also changes just a bit to say "immanetize committed with sanjayankur31".
This is the complete commit:
https://github.com/sanjayankur31/fpaste/commit/f05fa01ed35168750d33b856ac781144756b6156
Ok, I thought it was showing the person who committed and the person who pushed
I don't know if git lets you have a "committer" and a separate "pusher" - you just get a new "merge branch yadayada into master" type commit to show a merge I think?
I just thought of the sign off because it's a security related thing :)
@ankursinha i guess @pingou meant committer vs author. Author wrote the code but committer is the one who actually committed, maybe after changing the commit msg.
committer
author
Again, I don't know git in enough depth to know if you can have a "committer" and separate "author" - if you commit, you are the author, aren't you? Even if you change a commit message, you become the author - you're editing the history and this will require a force push since you're overwriting a past commit, no? Signing off is a bit different - it doesn't modify the commit, it just marks that it was signed off by someone, usually someone with commit rights. I think even merges can be signed off - people just don't do them often.
I just looked around and even Github doesn't permit you to sign off merges, so this can be a cool new feature that only Pagure has :)
Here's one person's take that seems quite sensible to me: https://ericjmritz.name/2015/06/22/why-and-how-i-avoid-githubs-merge-pull-request-feature/
He even speaks about how fast forward merges create unnecessary noise for single commit merges - something else worth thinking about, maybe?
Again, I don't know git in enough depth to know if you can have a "committer" and separate "author"
Well, if we're talking about this it is because there is such concept in git :)
As for the rest of your ideas, check the ticket list a few of these have already been discussed and my take has always been that I do not like the idea of pagure touching commits and much rather prefer to let users do it if they want to.
Yea - I found the documentation that clarifies what an author is and what a committer is. I hadn't thought of that part yet, just the signing off bit. Mabye github is doing author + committer, and I just happen to be a committer who also signed off in this case.
I agree that pagure shouldn't do anything to commits itself - this ticket only asks to display information, so it's in line with your philosophy :)
I see that the commit info page now shows author and committer info separately - was this recently added or was I just blind and didn't see it? XD
Please close this ticket when you see fit unless you want to keep it open to track the "double image" thingy github have going.
There has not been any changes to pagure since we release 2.2.1 before freeze
I think I'm going to close as is, doing the two images would mean specifying the two users as well as otherwise it makes little sense.
And the idea isn't to clone github on every way, so I'm thinking this should be fine as is :)
Yea. +1 Thanks :)