[samhclark]

Yeah. The agent can create commits and those commits are signed (`commit.gpgsign true`).

I'm treating it like...you can hold me accountable for that commit and the commit came from my computer. That feels like the right spirit of things.

How do you do commit signing? I've never worked anywhere it was common, nor worked on a team where anyone else signed commits. I don't know how it's really used in the wild, so to speak.

[danielheath]

> I don't know how it's really used in the wild, so to speak.

Commit signing primarily exists because linux kernel development happens via email, which isn't a secure channel.

In that context, signing is used to prove provenance; a commit signed by someone with merge rights gets included, and if you repeatedly sign bad code you'll have your right to merge revoked.

> you can hold me accountable for that commit

I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it.

[samhclark]

Makes sense, thanks for that context. I knew that linux kernel dev happens over email, but didn't piece that together with commit signing.

> I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it.

I think that's reasonable. I'd say that if I push the commit, then I should be accountable for it whether I read it or not (and no one is going to see it unless I push it).