3 ms·

It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push the

by yxhuvud 11y ago

It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this. The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

andrewstuart2 11y ago
If a user could upload their public GPG key to their account (as they can their public SSH key), GitHub could easily verify signed commits, which git itself allows with `git commit --gpg-sign[=<keyid>] ...`. It would be trivial for them to shell out to `git verify-commit <commit>` in order to verify that the claimed originator has signed his commits with a key tracked by github (by email address, which can belong to only one github user).
jerf 11y ago
A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would any indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.
icebraining 11y ago
An idea that doesn't require signing is tracking commits internally. If you push a commit made by you, Github can tag that as "trusted" (since you, the GH user, are vouching for your own commits). Then anyone who pulls them into their repo (even offline) and pushes it to their GH account would still have those commits tagged, since GH could match the hash with the ones it already knew about. For the most part, this would solve the problem, since people usually upload the commits to their own GH fork and then issue a PR.
facetube 11y ago
How about just showing who actually made the HTTPS or SSH connection to Github to push the changeset?

by yxhuvud 11y ago

andrewstuart2 11y ago

If a user could upload their public GPG key to their account (as they can their public SSH key), GitHub could easily verify signed commits, which git itself allows with `git commit --gpg-sign[=<keyid>] ...`. It would be trivial for them to shell out to `git verify-commit <commit>` in order to verify that the claimed originator has signed his commits with a key tracked by github (by email address, which can belong to only one github user).

jerf 11y ago

A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would any indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.

icebraining 11y ago

An idea that doesn't require signing is tracking commits internally. If you push a commit made by you, Github can tag that as "trusted" (since you, the GH user, are vouching for your own commits). Then anyone who pulls them into their repo (even offline) and pushes it to their GH account would still have those commits tagged, since GH could match the hash with the ones it already knew about. For the most part, this would solve the problem, since people usually upload the commits to their own GH fork and then issue a PR.

facetube 11y ago

How about just showing who actually made the HTTPS or SSH connection to Github to push the changeset?