3 ms·

I can understand signing patches sent over email. But for commits in any decent organisation one has to log in the network, have access rights to git, go throug

I can understand signing patches sent over email. But for commits in any decent organisation one has to log in the network, have access rights to git, go through code review, and then, finally, you have code committed into the repo. In these cases signing commits does not add much, if anything.

sverhagen 3y ago
Aren't access credentials for Git entirely separate from the name and email address in the commit? You can commit with anyone's name and email address. Verifying a commit through the user's log in, I wouldn't know how to do, but their commit being verified gives me trust that it was committed by the person whose name is on the commit.
- mytailorisrich 3y ago
  My point is that what you describe will be detected even before the commit reaches the master repo with the culprit fired as long as you have sensible processes. That's why I don't think commit signing adds anything within organisations. It might be a bit different with public open source repos on services like Github though I don't know how how to verify signatures...
avgcorrection 3y ago
It doesn’t seem hard to attribute 1/5 commit in a PR to another person. Then you publish it, no one checks out the individual commits (because that’s how forges are like in my experience), and it gets merged because the 2,000 line diff “LGTM”. I don’t really have belief in the processes of these corporate environment unless the auditing is given on a silver platter. Meanwhile on email: people get an email per patch, where the commit message part has to contain a `From:` line in order to override the email-is-author behavior. PS: There is a utility to giving commit authorship to someone else. Someone sends me the change through a DM. I commit it. Did I author it? No, so I give that to them. Not an exotic use-case at all of this seemingly nefarious feature.

sverhagen 3y ago

Aren't access credentials for Git entirely separate from the name and email address in the commit? You can commit with anyone's name and email address. Verifying a commit through the user's log in, I wouldn't know how to do, but their commit being verified gives me trust that it was committed by the person whose name is on the commit.

mytailorisrich 3y ago
My point is that what you describe will be detected even before the commit reaches the master repo with the culprit fired as long as you have sensible processes. That's why I don't think commit signing adds anything within organisations. It might be a bit different with public open source repos on services like Github though I don't know how how to verify signatures...

avgcorrection 3y ago

It doesn’t seem hard to attribute 1/5 commit in a PR to another person. Then you publish it, no one checks out the individual commits (because that’s how forges are like in my experience), and it gets merged because the 2,000 line diff “LGTM”. I don’t really have belief in the processes of these corporate environment unless the auditing is given on a silver platter. Meanwhile on email: people get an email per patch, where the commit message part has to contain a `From:` line in order to override the email-is-author behavior. PS: There is a utility to giving commit authorship to someone else. Someone sends me the change through a DM. I commit it. Did I author it? No, so I give that to them. Not an exotic use-case at all of this seemingly nefarious feature.