3 ms·
Only to the HEAD. If you publish the repo somewhere that does not do garbage collection, this can work.
by sam_lowry_ 4y ago
Only to the HEAD. If you publish the repo somewhere that does not do garbage collection, this can work.
- transpa-regency 4y agoIf you have a third party sign your git commits, you no longer can no longer modify the commit later undetectedly. And if someone puts their log of signatures into another git repository, you can create an entire web of timestamped trust. https://netfuture.ch/2022/02/git-pgp-blockchain-comparison/ https://netfuture.ch/2022/02/git-pgp-blockchain-comparison/
- michaelmior 4y agoThis is true. Although now this is starting to pretty closely approach what the OP is doing, just using another store for the signatures instead of the CT log.
- michaelmior 4y agoWhy does the fact that you can only do that to the HEAD matter? I can still fake any time in the past. Also, I'm not aware of any public host that does not do garbage collection. But even if that were the case, you still need to trust whatever the repository host is.