3 ms·
This is weak. Making commits more meaningful does not mean we need to handle the history of previous unsigned commits as the article asserts. You would simply
by nailer 3y ago
This is weak. Making commits more meaningful does not mean we need to handle the history of previous unsigned commits as the article asserts.
You would simply enact a policy that says from this day, all future commits must be signed in order to prevent future identity theft.
Yes, bad people may have snuck bad code into your repo in the past. it does not follow that it is unworthy to prevent bad code entering the repo in future
- deleted 3y ago[deleted]
- avgcorrection 3y agoWhy are you afraid of identity theft in this context?
- nailer 3y agoIf someone has your private key, they can act as you online.
- avgcorrection 3y agoThe private key that I would hypothetically sign commits with? Then signing commits is compromised too. I’m not sure what point you’re making. On the other hand if I don’t sign my commits then any signed commits (from my stolen private key (SSH)) look out of place. Like it’s weird that all these malicious commits are also signed, even though I have never signed commits.
- nailer 3y ago> The private key that I would hypothetically sign commits with? Yes. If someone has your private key they can sign commits as you. I’m not sure how I can put this more plainly.