4 ms·
Commits should really be signed. The first time I learned of this was when a malicious update was supposedly pushed to Tesla firmware. https://git-scm.com/book
by czbond 6y ago
Commits should really be signed. The first time I learned of this was when a malicious update was supposedly pushed to Tesla firmware.
https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
- threentaway 6y agoYou can even require signed commits in GitHub.
- yjftsjthsd-h 6y agoIf I'm signing commits, I can sign any commit I want with any time I want, no?
- inetknght 6y agoIf others are signing commits too, good luck changing history!
- OJFord 6y agoIf it's already shared history it would be too late anyway - thread is about lying when you authored/committed. Not really sure what the benefit in cheating your boss would be though? You still had to do the work at some time. Maybe you work extra hard one day but push only the first half of your commits, then give yourself a day off where all you do is check in at the end to push the fake-timed other half of them? It'd probably be easier to find an 'unlimited holiday' job that pays you for output rather than keeping your seat warm.
- Znafon 6y agoI think only tags should be signed, Torvalds has a good discussion about signing commits vs signing tags at http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...