3 ms·
While others could have a backup of a Git repository, I need to find them first — so discoverability is a problem. Next thing is integrity - how do I know that
by hashworks 6y ago
While others could have a backup of a Git repository, I need to find them first — so discoverability is a problem. Next thing is integrity - how do I know that the git history I receive has not been tampered with?
- IanCal 6y agoDo signed commits solve the integrity problem?
- hashworks 6y agoYes. Git commits include the hash of the previous commit, creating a cryptographic chain. If you can verify the signature at the tip of a branch you effectively verify the complete history of the branch. Sadly not every maintainer signs their commits or tags.
- Proven 6y ago1) Discoverability is not a problem. You don't need to discover anything, you just need to download the same repo again. If you forgot the name you're probably a super casual user (and not a dev) 2) Git history hasn't been tampered with just like it hasn't been tampered with in any of centralized Github repos. Doh.