4 ms·
It’s a security issue in the sense that it defeats the signing scheme: rather than negotiating the key out-of-band, the user is trusting the thing they’re tryin
by woodruffw 3y ago
It’s a security issue in the sense that it defeats the signing scheme: rather than negotiating the key out-of-band, the user is trusting the thing they’re trying to verify to supply the key. In other words “trust me because I’m signed, and also trust me to give you the key I’m signed with.”
On the other hand, approximately nobody actually verifies git commit signatures, so it doesn’t matter all that much :-)
- OJFord 3y agoI'm not really advocating for it, but GitHub does verify out of band - it uses keys on the profile. (If it says 'unverified', it doesn't match any that are present. If it says neither unverified nor verified, the commit wasn't signed.)
- jrms 3y agoI do. Deploys can only be rolled out if the tag was signed by a well known list of people (git pull --verify-signatures).