3 ms·
I have a keyring of my teammates' public keys at work. I can verify whether their commits come from them with a single local command - and so can our CI. You c
by seba_dos1 3y ago
I have a keyring of my teammates' public keys at work. I can verify whether their commits come from them with a single local command - and so can our CI.
You can download my public key from my website and I can tell you in person or over any other channel you trust whether it's correct. At this point, you can verify all my commits with a single local command.
Where does GitHub come into all this? I don't even use GitHub (unless contributing to a project that does).
- klabb3 3y agoThat's really nice. What tools are you using? How do you manage adding and removing keys? How many people and devices are involved? > Where does GitHub come into all this? To maintain verification dynamically for team members. Maintaining lists are otherwise (and in your example, I think) a N^2 maintenance task. Everyone needs to update their pubkey list when a team member adds or removes a device.
- seba_dos1 3y agoThe tool where keys are stored is called "a git repo". If you need to update your local copy of the keyring, you pull it.