Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

README: add warning about internet access #596

Merged
merged 1 commit into from
Nov 30, 2024
Merged

README: add warning about internet access #596

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,19 +32,27 @@ Single Repository:

```sh
cd /path/to/my/repository
git config --local commit.gpgsign true # Sign all commits
git config --local tag.gpgsign true # Sign all tags
git config --local gpg.x509.program gitsign # Use gitsign for signing
git config --local gpg.format x509 # gitsign expects x509 args

# Warning: Setting this will make git commit/tag reliant on internet.
# Alternatively, don't use these settings and add the -S flag instead.
git config --local commit.gpgsign true # Sign all commits
git config --local tag.gpgsign true # Sign all tags

```

All respositories:

```sh
git config --global commit.gpgsign true # Sign all commits
git config --global tag.gpgsign true # Sign all tags
git config --global gpg.x509.program gitsign # Use gitsign for signing
git config --global gpg.format x509 # gitsign expects x509 args


# Warning: Setting this will make git commit/tag reliant on internet.
# Alternatively, don't use these settings and add the -S flag instead.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The -S flag for commits will still rely on the internet, no? I wonder if this message belongs elsewhere more prominently for gitsign use as a whole?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, explaining that every signed commit now reaches out to the internet might be worth mentioning somewhere. I had setup this setting and then couldn't figure out why commits were happening so slowly.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

perhaps adding some text in the signing commits and signing tags sections makes sense? https://github.com/sigstore/gitsign/blob/main/README.md?plain=1#L115

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will be good to add some clarification in this section as well

git config --global commit.gpgsign true # Sign all commits
git config --global tag.gpgsign true # Sign all tags
```

To learn more about these options, see
Expand Down
Loading