4 ms·
Anybody can push a commit to a git repo with Linus Torvalds name and e-mail on it. With GPG signing, they can verify that the claimed author signed off on the c
by MBlume 11y ago
Anybody can push a commit to a git repo with Linus Torvalds name and e-mail on it. With GPG signing, they can verify that the claimed author signed off on the commit.
- wyldfire 11y ago> Anybody can push a commit to a git repo For folks who haven't seen the Torvalds "graffiti" on github, it's critical to distinguish here: "anybody can push a commit to /their/ git repo".
- cyphar 11y agoExcept that's not how it actually works (you can push fake commits to your repos). If someone can log into your account (to be able to push fake commits to the account's repos) they can also add their GPG key. The point is that no additional security is added by this feature.
- MBlume 11y agoWithout this feature, I can push commits up to my repo and claim they were written by you; with this feature, people can tell whether you signed off on those commits.
- cyphar 11y agoSo what? That implies that someone should believe someone when they say "look, the email address on this commit says this person's name -- it must be that person!". This all comes down to repo ownership. In your fork of a repo, you have the ability to fake any history you want. Why should that bother me? GitHub should stop auto-associating emails to usernames -- that's the actual problem here.