3 ms·

That's why it's just a gimmick. Signing only works as protection against hosting compromise if the signing/verification is separate from the hosting itself. So

by megous 6y ago

That's why it's just a gimmick. Signing only works as protection against hosting compromise if the signing/verification is separate from the hosting itself. Someone responsible for release would have to manually keep a list of keys of authorized comiters and check the repository against this list at the very least prior to a release.

kenmacd 6y ago
The number of people with direct commit access is almost certainly less than the number of commits in a release though. Without signatures you have to verify every commit.
- megous 6y ago
  I'm not against signatures. I just think relying on third party system to verify them is a gimmick.