3 ms·
In our group's use case, we're not after the "implicitly-signed" property. We are trying to ensure that the person who is listed as doing the commit actually d
by CaliforniaKarl 9y ago
In our group's use case, we're not after the "implicitly-signed" property. We are trying to ensure that the person who is listed as doing the commit actually did the commit. We then have a server-side hook script, which ensures each new commit has been signed by a key kept in a local keyring.
- hdhzy 9y agoJust out of curiosity do you somehow update the local keyring? So that one can update their key information (for example to add revocations and new keys).
- CaliforniaKarl 9y agoThere's a single-digit number of people who can update the local keyring. Which works right now, given that the number of people who push to the repos concerned is in the double-digit range. Our PGP keys don't really change that often.