5 ms·
If you autosign every commit then you aren't validating anything anyway. All that means is you have another mindless process running automatically in the backgr
by MikkoFinell 10y ago
If you autosign every commit then you aren't validating anything anyway. All that means is you have another mindless process running automatically in the background. So what's your point?
- viraptor 10y agoYou're talking about two different threats / attacks: 1. Someone got access allowing them to push commits. 2. Someone got access allowing them to push commits and also got unrestricted access to the trusted PGP key. In the first case, auto-signing will expose the issue. In the second, not. But in the second case, you're likely screwed in many other ways.