Setting the author in a codespace to somebody else does not show that you are the committer

[spenserblack]

Select Topic Area

Bug

Body

I have 2 example commits, using git commit --allow-empty --author="Ghost <ghost@github.com>" --no-gpg-sign:

• commit made locally: spenserblack/test-repo@209ea52
• commit made in codespace (web editor): spenserblack/test-repo@3d5acac

In the local commit, it shows that @ghost is the author, but I am the committer, as expected. However, the commit made in the codespace doesn't show that I committed on behalf of @ghost.

I guess this is because the committer is GitHub <noreply@github.com>. But this behavior makes it easy to accidentally "spoof" a user when your intent is to give them credit for their code. If the user doesn't normally sign their commits, it will look very similar to their other commits when viewing in GitHub's web UI.

I wonder if it would be possible to make the committer the user of the codespace, instead of GitHub <noreply@github.com>? Or maybe something like First Last via GitHub <user-email@github.com>?

---

Also, apologies if codespaces is not the right category. I'm not sure if this should be resolve in how codespaces behave, or how the web UI shows commits.

[samruddhikhandale]

Hi @spenserblack 👋

GitHub <noreply@github.com> is the email address for the key we use for GPG signing, so in order for the signature to be valid we have to use that email.

However, you could make another author commit in a Codespace without passing --no-gpg-sign to the git commit command.

Example -

Command - git commit --allow-empty --author="Josh Spicer <joshspicer@github.com>"
It created the commit correctly - samruddhikhandale/cs-examples@b5a0b72

[spenserblack]

Thanks for the reply!

I played around with it a little bit, and it seems like your suggestion only works if I disable GPG verification in /settings/codespaces.

git commit --allow-empty --author="Ghost <ghost@github.com>": spenserblack/test-repo@5ed5788
After re-enabling GPG Verification for all repos I got error: gpg failed to sign the data.

So I guess I need to disable GPG Verification in Codespaces if I want to use --author=? Looks like the commit you linked is unsigned.

[joshspicer]

If you enable GPG commit signing in the Codespaces settings, we will sign your commit on your behalf after validating your Codespace's credentials, and therefore need the user and email to be what Samruddhi shared above. We never have access to your private GPG key, so we aren't able to sign them on your behalf. I think it would be misleading for GitHub to indicate the signature came from you when we are indeed signing the commit.

If you require the commits to be signed by you, you could possibly add your GPG secret as a Codespace secret and wire up your git client to use that gpg key for signing (perhaps through dotfiles personalization. I don't believe this is a use case we have documented, however.

Please let me know if that is helpful or if I can clarify anything.

[spenserblack]

Yes, it was helpful, thanks!
I wonder if it is possible to make the committer something First Last via GitHub <noreply@github.com> so that it's slightly more informative who the committer is, instead of just GitHub <noreply@github.com>. Does only the committer email need to match the web flow GPG signature, or both committer name and email? But, either way, both of your answers have been very helpful!