4 ms·
This is a great example of why you should enable vigilant mode [1] on your GitHub account and set your machine up to GPG sign your commits. [1] https://docs.gi
by shhsshs 5y ago
This is a great example of why you should enable vigilant mode [1] on your GitHub account and set your machine up to GPG sign your commits.
[1] https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits https://docs.github.com/en/github/authenticating-to-github/m...
- teitoklien 5y agoBut if you gpg sign your commit Now all your contributors will have to sign their next commits too. My workmates would hate me if i introduced this to production.
- rsstack 5y agoI am the only person on my team who signs their commits. No one complained or noticed.
- jeroenhd 5y agoWhy do they have to sign their commits? Their contributions are unverified, as are any commits made in your name without your signature, but they don't have to do anything. You gain the ability to prove that a certain commit came from your machine or someone with full access to it, they don't. To be honest, everyone should be signing their commits in a professional environment. It takes minutes of work to set up and greatly increases the trust you can have in the code base. If you're scared of affecting your workflow, just don't protect the GPG keys with a password (dangerous) or use your operating system's trust store to unlock them at login (less dangerous, but still suboptimal). I sign my work commits without ever entering a password in a prompt. Some of my coworkers also sign their commits, most of them don't.
- bentcorner 5y agoIf you don't sign your commits you leave yourself an escape hatch just in case you need to wash your hands of a PR. /s
- teitoklien 5y agoThanks a lot for explaining it ! I’ll start using it then
- taf2 5y agoIt’s not that bad - its just an initial thing to setup then it’s pretty automatic for every commit
- teitoklien 5y agoAwesome then :D I’ll start using it Thanks a lot !
- shhsshs 5y agoAnyone can choose for themselves whether or not to use gpg. Your choice doesn't affect anyone else. https://i.imgur.com/TqbfZaP.png https://i.imgur.com/TqbfZaP.png
- teitoklien 5y agoThanks a lot for showing it ! Really appreciate it I’ll give it a try indeed !