4 ms·
This is hilarious! Got a good laugh from this. It also illustrates how easy it is to impersonate other people in Git. I’m surprised this isn’t discussed more.
by 40four 5y ago
This is hilarious! Got a good laugh from this. It also illustrates how easy it is to impersonate other people in Git. I’m surprised this isn’t discussed more.
To be honest, when you really think about it, any commit that is not GPG signed is unverifiable. It could be anybody. I wish signing commits was more widespread.
- baud147258 5y agoyeah, we recently started switching from mercurial to bitbucket (not our choice) and we took the time to make commit signing mandatory, piggybacking on the infrastructure that was already in place to sign the mercurial commit, but with new gpg keys as the mercurial commits were signed with p12 keys, which are not supported by git/bitbucket (can't remember which).