From 4f48913640c0e6ab29cf82fbfba7ebfd6733cec3 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 19 Oct 2026 22:58:38 +0000 Subject: [PATCH 1/2] notes: how branches for upstream PRs get signed Upstream now requires Verified commits and fast-forward merges. Cloud sessions cannot sign, so record the routine: sessions prepare branches unsigned, the owner re-signs with upstream's own rebase --exec command on a machine that holds the key, and checks with %G? before pushing. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GqBtj4KbxVrGMBVZ4gNFUi --- notes/commit-signing.md | 46 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 notes/commit-signing.md diff --git a/notes/commit-signing.md b/notes/commit-signing.md new file mode 100644 index 0000000..116cc0c --- /dev/null +++ b/notes/commit-signing.md @@ -0,0 +1,46 @@ +# Signed commits for upstream PRs + +JoshuaJewell/MetaManifold-WebUI requires every commit to show as **Verified** on +GitHub, and merges by fast-forward only (CONTRIBUTING, "Pull requests", items 3 +and 8, from upstream `bf1d3ef`). The commits on the branch are the commits that +land on `main`, so each one must build, pass and carry a message that stands on +its own. + +## Who signs + +Claude Code cloud sessions cannot sign: there is no signing key in the +container, and putting a private key in an environment secret is not worth the +risk. So a session prepares the branch unsigned, and the signing happens on a +machine that holds your key. + +Your signing already works: the heads of upstream PRs 62 and 63 were Verified +on 2026-10-19. + +## The routine + +On the machine with your key, for a branch a session prepared: + +```sh +git fetch upstream main # JoshuaJewell/MetaManifold-WebUI +git switch +git rebase upstream/main # only if main moved, or when asked +git rebase --exec 'git commit --amend --no-edit -S' upstream/main +git log --format='%h %G? %s' upstream/main..HEAD # every line must not be N +git push --force-with-lease origin # before review starts only +``` + +`%G?` prints `N` for unsigned. `E` usually means local git cannot check an SSH +signature (no `gpg.ssh.allowedSignersFile`); GitHub's Verified badge is what +counts. Re-check on the PR's Commits tab. + +## Rules that follow from fast-forward merging + +- Before review starts, rebase and re-sign freely. +- Once review has started, add commits; rebase only when Joshua asks, and + re-sign when you do. +- Never merge `main` into a PR branch: the merge commit would land on his + `main`. + +## Branches known to need re-signing + +- `wip/pr62-theta` (3 unsigned commits, 2026-10-19), if it becomes a PR. From a77921405afeb7ffff274c64a7ee38a73b2cf60b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 19 Oct 2026 23:06:42 +0000 Subject: [PATCH 2/2] notes: a %G? table that rejects bad signatures; force-push after a requested rebase Review on #191: "not N" let bad, expired and revoked signatures pass, and the push line forbade the force-push a requested rebase needs. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01GqBtj4KbxVrGMBVZ4gNFUi --- notes/commit-signing.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/notes/commit-signing.md b/notes/commit-signing.md index 116cc0c..0ae6671 100644 --- a/notes/commit-signing.md +++ b/notes/commit-signing.md @@ -25,13 +25,20 @@ git fetch upstream main # JoshuaJewell/MetaManifold-WebUI git switch git rebase upstream/main # only if main moved, or when asked git rebase --exec 'git commit --amend --no-edit -S' upstream/main -git log --format='%h %G? %s' upstream/main..HEAD # every line must not be N -git push --force-with-lease origin # before review starts only +git log --format='%h %G? %s' upstream/main..HEAD # see the table below +git push --force-with-lease origin # before review, or after a requested rebase ``` -`%G?` prints `N` for unsigned. `E` usually means local git cannot check an SSH -signature (no `gpg.ssh.allowedSignersFile`); GitHub's Verified badge is what -counts. Re-check on the PR's Commits tab. +What `%G?` prints, and what to do: + +| status | meaning | action | +| --- | --- | --- | +| `G` | good signature | pass | +| `E`, `U` | local git cannot check it, or the key's validity is unknown (`E` is usual for SSH signing without `gpg.ssh.allowedSignersFile`) | push, then confirm Verified on the PR's Commits tab | +| `N` | unsigned | re-sign | +| `B`, `X`, `Y`, `R` | bad signature, expired signature, expired key, revoked key | stop; fix the key, then re-sign | + +GitHub's Verified badge is what upstream checks. ## Rules that follow from fast-forward merging