Hello! This topic is a kind of non-security bug report. Please, notify my if there is a better place for such requests.
The issue is based on this SO discussion. In two words, when I perform re-signing and force-pushing via plain old git
git rebase --exec 'git commit --amend --no-edit -n -S' -i --root git push --force
GitHub overrides the dates of all affected commits. While git itself persists the original dates along with the date when the last gpg-signing was made. For example,
git log --show-signature is showing
commit 4078f3c..............3cda gpg: Signature made Fri Nov 20 18:23:47 2020 MSK gpg: using RSA key 6E0E.............79EF gpg: issuer "my@email" gpg: Good signature from "Denis Hilt <my@email>" [ultimate] Author: dhilt <my@email> Date: Thu Aug 18 16:16:01 2016 +0300 initial sources commit
And we see Aug 18, 2016 as the date of commit and Nov 20, 2020 as the date of gpg-signing. And the same entry on the GitHub (after force-push) as follows:
It ignores the real commit date and shows the date of last gpg-sign instead. I believe it should not be so. The date of last gpg-sign could be shown in the GPG popup:
It is quite important for the GitHub to reflect the same original commit date as the git provides via
Is this the right place for my question? Where should I raise it if not?