> One interesting voice in signing all commits by Linus: >> Signing each commit is totally stupid. It just means that you automate it, and you make the signatu

> One interesting voice in signing all commits by Linus: >> Signing each commit is totally stupid. It just means that you automate it, and you make the signature worth less. I've never bought that argument.[0] You should use whatever method actually addresses your threat model. If you're going to sign every commit (I do), then commit (no pun intended) to doing so properly. I use `git add -p` for every commit and review my changes, and enter my smartcard PIN for every single commit. I use it to assert my identity on those commits. If you automate signing past commits, then you open yourself up to attack. Saying "this idea is stupid because everyone is going to do it wrong" is not the basis of a strong argument. The other part of his argument is that the DAG itself allows you to just sign a single commit to verify the entire history. Firstly: that's different than signing each commit, which asserts identity of the author. Secondly, which has always been my argument, is that it rests on the security of SHA-1, which has been under question for quite a while, and has since been demonstrably broken. Are second preimage attacks unlikely with SHA-1? At least today, yes. Consider your threat model. Linus didn't even do that. He said long ago that SHA-1 was intended for integrity, not security, so retrofitting it in an argument is also not useful. [0]: https://mikegerwitz.com/papers/git-horror-story#merge-3 https://mikegerwitz.com/papers/git-horror-story#merge-3 ([0] from 2012 doesn't address the issue in this thread---expired or revoked keys.)