Re: [PATCH] Add .gitconfig variable commit.gpg-sign

On Tue, Apr 23, 2013 at 8:25 PM, Junio C Hamano [off-list ref] wrote:

Yup.

And then we would need to add the same option to existing callers of
"git commit" (such as "git rebase") to pass it down the callchain.

Got it.

But stepping back a bit, I have a suspicion that your upstream
project _only_ cares about what you feed them (either by pushing
your work yourself to them, or telling them to pull from your
repository).  There is no reason for you to be constantly signing
your commits you make during your exploratory development that you
may throw-away in the end.

Your suspicions are correct.
But I'm a bit paranoid, so it feels better to sign even local commits.

It _might_ be a better option to just teach "-S" option to "git
rebase" that tells it to replay all the commits with "commit -S",
instead of adding commit.gpgSign configuration.

In my case, I don't do that much exploratory development locally,
so I usually just commit, pull and push.

Always signing everything can't really hurt, can it? Takes a few clock
cycles more, and a few more bytes, but apart from that I don't see any
problems?