4 ms·
I would add that you shouldn't trust GitHub not to lie to you, and verify signatures for yourself. One need not attribute malicious motives to GitHub in this sc
by fabulist 11y ago
I would add that you shouldn't trust GitHub not to lie to you, and verify signatures for yourself. One need not attribute malicious motives to GitHub in this scenario; they could get hacked, served with an NSL, successfully man-in-the-middled, or inadvertently hire a bad actor.
- coroutines 11y agoI completely agree. I was thinking it'd be nice if you could set a signing policy on GitHub - either all commits are signed or none are. A mixed situation just leads to harmful confusion. You would still need to verify sigs yourself, but if they're available for every commit this does still save you time before creating the signed tag.