3 ms·
Sign your commits if you care about this! iirc, isn't signing with the same ssh key you push with a possibility?
by whateveracct 5y ago
Sign your commits if you care about this!
iirc, isn't signing with the same ssh key you push with a possibility?
- MaxBarraclough 5y agoI believe you could do that yes, but I don't think it's recommended. My understanding is that git itself offers no real solutions to the questions of key-management, especially revocation and rotation, so you're essentially on your own for all of that. Revocation seems especially tricky as it seems directly at odds with git's model of immutable commits. I don't know if there's a robust solution out there.