5 ms·
It's because Git is decentralized, and when you push a repo to GitHub it could contain genuine commits from other people that you've pulled into your repo from
by agwa 12y ago
It's because Git is decentralized, and when you push a repo to GitHub it could contain genuine commits from other people that you've pulled into your repo from some other, non-GitHub source. There's no way for GitHub to authenticate such commits.
There is definitely a potential for abuse, but can you solve it without breaking useful functionality?
- mitchty 12y agoGPG sign your commits in git if its an issue.
- agwa 12y agoAgreed, but GitHub doesn't show any indication that a commit has a valid GPG signature, so a casual visitor to GitHub wouldn't know if a commit is genuine or not.
- erichurkman 12y agoEven git itself does not show signature information by default in `git log` and friends.