3 ms·
> "Signing commits means that no one can sneak malicious content into your repository Signing commits does not mean that even when using cryptographically secu
by seba_dos1 4y ago
> "Signing commits means that no one can sneak malicious content into your repository
Signing commits does not mean that even when using cryptographically secure hash function. All it means is that you put your signature over a particular state of the repo (and, by extensions, its parent states). It has nothing to do with preventing "sneaking things in" - although it could be a (small) part of the whole set of measures taken to prevent someone from doing that.
- eru 4y ago> All it means is that you put your signature over a particular state of the repo (and, by extensions, its parent states). That's technically true. Though in practice I think the implied social contract is that signing of a commit means you signal some kind of approval for the diff between the signed commit and its immediate predecessor(s).