4 ms·

Really? GH Enterprise definitely verifies GPG.

• kevincox 5y ago
  It verifies the signature but I was able to just add a public key that I found online to my account.
  • devrand 5y ago
    Will Github verify a commit associated with a GH account via an unverified e-mail address? If so then it's probably fine since you would have to demonstrate ownership of an e-mail address that was contained in the signed payload, or you would have to be able to sign payloads yourself (i.e. you have the private key).
• globular-toast 5y ago
  How does it verify them? They could ask you to sign a message to prove that you control the private key, but I don't think public Github (or Gitlab) does this. They just assume you hold the private key to any pubkey you upload. Alternatively your private installation could have a centralised trust store of keys.