10 ms·
Unless you make sure to only have signed commits it's pretty easy to impersonate someone in Git repo.
by ilyt 3y ago
Unless you make sure to only have signed commits it's pretty easy to impersonate someone in Git repo.
- eastbound 3y agoSo the main architect goes to prison. At one point, he put the system on production, so it doesn’t matter who was the original programmer, he had to check.
- richbell 3y agoTrue, though GitHub at least tracks the authenticated user that pushed the commit.
- sneak 3y agoMost people are convinced to take plea bargains based on primarily circumstantial evidence. The idea that unsigned commits are questionable is really only a cypherpunk fantasy. If you get as far as a federal criminal trial, you're almost certainly getting convicted regardless of what cryptographic signatures do or do not exist.