3 ms·
Says it signs the commit with its own key. I guess you have to trust GitHub.
by chrisseaton 5y ago
Says it signs the commit with its own key. I guess you have to trust GitHub.
- Felk 5y agoWell, yes. The question was whether you can sign _on GitHub_, so your private key has to be available to GitHub. You can always sign locally if you don't trust GitHub.
- drexlspivey 5y agoWhat else would they be signing with? They don’t have your key obviously
- chrisseaton 5y agoWell that was my point - I wonder why we haven't set up a system that lets me sign the merge commit. Otherwise it's a commit purported to be authored by me but when you look it's actually signed by someone else.