4 ms·
> we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be. One issue is that you are
by im3w1l 6y ago
> we recommend people sign their commits and look for the 'verified' label on GitHub to ensure that things are as they appear to be.
One issue is that you are loading profile images and creating links based on unverified emails (if I click the little picture next to the commit message I get to the impersonated profile). I mean I get that a proper solution might introduce unacceptable friction, but you can't really blame users for misunderstandings in the current state either.
- DarkWiiPlayer 6y agoMaybe, instead of just not having a green "verified" indicator, add a red "unverified" indicator for users that do have a PGP key added? Maybe add a checkbox in your profile like "Specifically mark unsigned commits" or even "don't associate unsigned commits to my account" as well.
- OJFord 6y agoOr: > (!) This user usually signs their commits, but this commit is not signed. [Learn more] Is what I've been surprised there isn't something like in the past.
- easton 6y agoThey have a grey unverified thing that pops up if there was an error when using GPG to sign the commit, I wonder why it doesn’t show up the rest of the time when you don’t sign something at all.