4 ms·
This falsely assumes signing and trust is somehow tied to GitHub. GPGs web of trust has issues but it allows verifying outside GitHub.
by ZiiS 3y ago
This falsely assumes signing and trust is somehow tied to GitHub. GPGs web of trust has issues but it allows verifying outside GitHub.
- kohbo 3y agoYou're right, but also, commit signing is useless if there’s nobody on the other side verifying that the signature can be trusted. GitHub is doing that right now but that also ties projects to GitHub. It's Microsoft's way off ensuring OSS development has to go through their gates.
- ZiiS 3y agoYou can `git verify-commit` yourself. Gpg allows you to build a web of trust so you can find other people who trusts the commiter's key.