4 ms·
It is simply an audit trail to trace back to the origin, since anyone can set any email address as the author of a commit. GitHub will show the signature finger
by sixstringtheory 7y ago
It is simply an audit trail to trace back to the origin, since anyone can set any email address as the author of a commit. GitHub will show the signature fingerprint I think when you hover over that widget, so you can at least distinguish between your key and an impostor’s.
I use this but it causes weird usability issues for me when using multiple iTerm tabs or git GUIs when the GPG daemon’s unlock timeout expires and I need to input my passphrase in again. I wish it could just be tied to the mac’s keychain, so when I unlock my computer it is ready to go. Or at least tie it into TouchID or Watch like unlocking the mac does.
- trishankdatadog 7y agoYes, it's so easy with this YK setup that there's no reason not to do it. The only exception is during rebase, but there's an option in GPG to disable signing then. I sign all my commits so that everyone knows it was most likely me. You can even turn on branch protection in GitHub these days that rejects unsigned commits. With all due respect, Mr. Torvalds isn't exactly famous for having designed the most secure kernel.