Commits are not signed and approvers do not sign anything either. Nothing stops a malicious Github employee, bribed maintainer, or someone who simply phished Gi

Commits are not signed and approvers do not sign anything either. Nothing stops a malicious Github employee, bribed maintainer, or someone who simply phished Github credentials from making a fake PR as someone else then approving it themselves or serving manipulated git history only to CI/CD systems. Major supply chain attacks like this have happened in lots of other package managers and most OS package managers at least learned their lesson and signs everything. Most package managers are blindly used in multi billion dollar applications, so they are a huge target for attack. * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d2258e1ed91599a8091167002 https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00003.html https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/ https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/651 https://github.com/canonical-websites/snapcraft.io/issues/65... * Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html https://lists.archlinux.org/pipermail/aur-general/2018-July/...