7 ms·
That only solves authentication, not authorization.
by dietrichepp 11y ago
That only solves authentication, not authorization.
- tajen 11y agoSo you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before the release.
- chei0aiV 11y agogit supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though: http://mikegerwitz.com/papers/git-horror-story http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-story-loose-nonces/ https://developer.atlassian.com/blog/2015/05/git-horror-stor...