3 ms·
Just use an ssh key for authentication and there is no need to sign commits.
by dheera 3y ago
Just use an ssh key for authentication and there is no need to sign commits.
- rmwaite 3y agoHow does SSH authentication provide the same guarantees as signing commits?
- dheera 3y agossh itself is cryptographically secure. the ciphertext of the commit being pushed is as good as a signature
- defanor 3y agoI guess you are considering the case where a single signer transfers commits over SSH to a single verifier, with both putting the same meaning into the act of transfer as people normally would into a signature. But git is a distributed VCS, with signatures handling many more scenarios: consider multiple committers and multiple signatures, transfer over multiple, different, untrusted channels, multiple verifiers.
- deleted 3y ago[deleted]