8 ms·
Doesn't git use GPG to sign commits?
by curt15 3y ago
Doesn't git use GPG to sign commits?
- dale_glass 3y agoYes, why? And I believe these days you can use SSH keys for signing commits as well.
- Zizizizz 3y agoYou can use SSH keys as well.
- dheera 3y agoJust use an ssh key for authentication and there is no need to sign commits.
- rmwaite 3y agoHow does SSH authentication provide the same guarantees as signing commits?
- dheera 3y agossh itself is cryptographically secure. the ciphertext of the commit being pushed is as good as a signature
- defanor 3y agoI guess you are considering the case where a single signer transfers commits over SSH to a single verifier, with both putting the same meaning into the act of transfer as people normally would into a signature. But git is a distributed VCS, with signatures handling many more scenarios: consider multiple committers and multiple signatures, transfer over multiple, different, untrusted channels, multiple verifiers.
- deleted 3y ago[deleted]