When I import using the command "gbp import-orig --uscan" none of the created commits are GPG signed.

My global GPG signature is enabled and using the git command line everything goes well for me.

Expected: create commits that are GPG signed for merges, upstream commits and pristine tar commits
Actual: creates commits without a GPG signature, I need to amend them to add a signature.

Thanks

To patch adding GPG signing on the upstream version commit:

Onto "git/repository.py", add

         args += ['--gpg-sign']# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972273


To the "commit_tree" function


The same has to be done to "pristine-tar" at: https://salsa.debian.org/debian/pristine-tar/-/blob/debian/1.50/pristine-tar#L1146

Thanks for reporting
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972273 in 2020. I
think this would be a useful feature.

I have in my ~/.gitconfig:

[tag]
gpgsign = true
[commit]
gpgsign = true

Thus all my tags are automatically signed. But it would be valuable
for Debian as a whole if git-buildpackage enforced signing of the
upstream/<version> tags.

Would you like to work on it a bit more and submit it at
https://salsa.debian.org/agx/git-buildpackage/-/merge_requests?

Hi Otto,

Yes, but I have no time on my hands to do so.
Feel free to route this to someone that wants to do a good first contribution :)

That would be great to finally have full GPG signing.