3 ms·
Just require commits that are signed off with GPG keys. Then you have a clean, verifiable audit trail through git. Beyond that, you'll have the full development
by mdwrigh2 14y ago
Just require commits that are signed off with GPG keys. Then you have a clean, verifiable audit trail through git. Beyond that, you'll have the full development history on your machine, which they can't just arbitrarily change.
- einhverfr 14y agoDo you think that's more or less complex than just using svn-git to manage the authoritative audit-trail repository?
- mdwrigh2 14y agoLess, managing two version control systems seems like insanity (speaking as one who's had to do it in the past). Having people sign their commits is dead simple in Git, and you could setup hooks to make sure every commit is signed before you accept it. An alternative (or additional) solution is to setup a server like Shawn suggests in this e-mail: http://git.661346.n2.nabble.com/Implementing-commit-signing-tp1312464p1312616.html http://git.661346.n2.nabble.com/Implementing-commit-signing-...