3 ms·
IMHO git does it right. If signature was only at the commit level you could do a variant of replay attack. For example you could cherry-pick all commits except
by pornel 11y ago
IMHO git does it right. If signature was only at the commit level you could do a variant of replay attack.
For example you could cherry-pick all commits except security fixes and create a malicious version of the software that has all commits still signed by the original author.
- Argorak 11y agoI was not saying that the signature is _just_ at a commit level ("patches" being the DARCS lingo). DARCS, just as git, has tags for that. A tag depends on all previous patches, so a signed tag guarantees just the same as a signed git tag does. In that regard, git is strictly less powerful.