2 ms·
Aren't access credentials for Git entirely separate from the name and email address in the commit? You can commit with anyone's name and email address. Verifyin
by sverhagen 3y ago
Aren't access credentials for Git entirely separate from the name and email address in the commit? You can commit with anyone's name and email address. Verifying a commit through the user's log in, I wouldn't know how to do, but their commit being verified gives me trust that it was committed by the person whose name is on the commit.
- mytailorisrich 3y agoMy point is that what you describe will be detected even before the commit reaches the master repo with the culprit fired as long as you have sensible processes. That's why I don't think commit signing adds anything within organisations. It might be a bit different with public open source repos on services like Github though I don't know how how to verify signatures...