13 ms·
It would only allow commits signed by me to be pushed under my email. Github uses the email as the "proof" of commit ownership. By only accepting signed commits
by stevelacy 4y ago
It would only allow commits signed by me to be pushed under my email.
Github uses the email as the "proof" of commit ownership. By only accepting signed commits a user would not be able to push a commit impersonating me.
- irjustin 4y agoThat solves impersonation, but that is not a related problem here. These repos were not taken over but cloned and made to look like another repo via similar naming. I think what you're looking for is more "all accounts must be verified via payment/identity" then you really know who is making "random clones" and "look-a-likes" w/ malware. But you've got a whole host of other problems in the process.