20 ms·
> Some security-focused developers sign git tags and/or commits, specifically to have things verifiable end-to-end and not having to trust HTTPS and all the mid
by _pmf_ 10y ago
> Some security-focused developers sign git tags and/or commits, specifically to have things verifiable end-to-end and not having to trust HTTPS and all the middle men that entails.
This is a completely orthogonal, separate layer of security that has nothing to do with this particular issue.
- tokenizerrr 10y agoMaybe quote the second line as well? > Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious version that verifies fine since it has the same hash the original developer signed. What's your response to this? To me it seems like this would be a serious issue.
- _pmf_ 10y agoYou're right.