3 ms·
I'm thinking more like the recent PHP repository compromise. I was thinking at some point that I may want to host my own git public repos, but they might not be
by orblivion 6y ago
I'm thinking more like the recent PHP repository compromise. I was thinking at some point that I may want to host my own git public repos, but they might not be safe. My solution could be to ask people to check my signatures.
- rakoo 6y agoI haven't read a lot about that issue but if I understand correctly a malicious actor had write access to the repo, and yes signing tags could have prevented this push to be problematic (I don't know if they're signing content or not). It's always good to check signatures especially when we have the tools to do that automatically