Cannot trace who pushed a git branch

[Robie Basak]

In the spec for git-ubuntu staged uploads[1], we require the person who pushes a staged branch to take responsibility for that change in the subsequent upload that will be signed by someone else.

Simon pointed out that it's not possible to determine who actually pushed a branch. Since that's distinct from the person who is a named committer or author of a commit (and even those can be spoofed).

For this principle of social responsibility to work reliably, we need to be able to determine for certain who made the choice to push the branch (as opposed to, for example, someone who proposed a branch for review but perhaps didn't consider it ready for upload yet).

Colin suggested that Launchpad could expand its git activity table to track push activity (eg. a timestamp, who did it, the old and new commit hashes and the ref name) and make this available by API.

Then it would be possible to determine the responsible person when required.

I don't think we need to do this from day one, but Colin suggested at least collecting the data even if it's not exposed by API yet. Then a manual query would be possible should it be required.

[1] https://discourse.ubuntu.com/t/spec-git-ubuntu-staged-uploads/35409