3 ms·
What about the global .gitconfig? One of the basic key value pairs is the GPG signingkey, which is usually stored in cleartext in the aforementioned file. Alth
by chrisfinazzo 6y ago
What about the global .gitconfig?
One of the basic key value pairs is the GPG signingkey, which is usually stored in cleartext in the aforementioned file. Although the credential.helper is in my Keychain (iCloud-backed 2FA)
In theory someone could copy this and try to sign commits as me, but I have to think this value is unique and they would get rejected if they tried to use it.
My login credentials are 2FA as well, at least on unknown machines, so they would be prompted there as well.
Personal Access Tokens for the CLI would be another way to prevent nefarious things from happening.