backport automation: to cherry-pick the signed commits

[v1v]

Expected Behavior
When backporting with https://docs.mergify.com/actions/backport/ the new PR contains the signed commits from the original author.

Actual Behavior
Mergify seems to be cherry-picking the squashed commit hence no verified badge

Steps to Reproduce the Problem
Create a PR with signed commits
@Mergifyio backport
Specifications
Pull Request URL: elastic/apm-server#10227 is the original PR request and https://github.com/elastic/apm-server/pull/10521/commits is the automated backport happened with mergify
Mergify Config URL: https://github.com/elastic/apm-server/blob/main/.mergify.yml
Probably I messed up with some configuration and hence that's the expected behaviour, please bear with me and thanks so much for your great product!!

[jd]

Not sure we could have anything verified even by cherry-picking the original commits, since the sha1 are going to change anyway and Mergify can't re-sign the commits using the original author key. Or do I miss something?

[v1v]

Gotcha, I understand there is a limitation with the git flow itself, so nothing we can do about it.

For now, since mergify can override the branch protection behaviour, we enabled to auto-approve those backported PRs with mergify itself, so it works smooth and nice in our end.

Thanks Julien, I guess we can close this issue now

[jd]

@v1v we spent time digging into that features, but it's not really clear the value of the whole signature system, especially with things like https://blog.mergify.com/un-signed-commits-how-we-found-a-non-security-bug-in-github/

Would it be possible to have more context about what's expected from the GitHub setting? Happy to schedule a chat with you or your (security) team.