You can use git request-pull
to achieve the same kind of workflow (which is improved with Git1.7.9+).
See the article "using signed tag in pull-requests"
A typical distributed workflow using Git is for a contributor to fork a project, build on it, publish the result to her public repository, and ask the "upstream" person (often the owner of the project where she forked from) to pull from her public repository. Requesting such a "pull" is made easy by the git request-pull
command.
Starting from Git release v1.7.9, a contributor can add a signed tag to the commit at the tip of the history and ask the integrator to pull that signed tag.
When the integrator runs git pull
:
- the signed tag is automatically verified to assure that the history is not tampered with.
- In addition, the resulting merge commit records the content of the signed tag, so that other people can verify that the branch merged by the integrator was signed by the contributor, without fetching the signed tag used to validate the pull request separately and keeping it in the refs namespace.
With Git 2.40 (Q1 2023), "git request-pull
"(man) can strip embedded signature from signed tags using non-PGP signatures.
See commit a9cad02 (25 Jan 2023) by Gwyneth Morgan (gwymor
).
(Merged by Junio C Hamano -- gitster
-- in commit ad7fd3c, 08 Feb 2023)
request-pull
: filter out SSH/X.509 tag signatures
Signed-off-by: Gwyneth Morgan
git request-pull
(man) filters PGP signatures out of the tag message, but not SSH or X.509 signatures.