6 ms·
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions. Were I to do it I would require
by mitchty 12y ago
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions.
Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
- robryk 12y agoSigning of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
- TheLoneWolfling 12y agoNot necessarily. It could do key pinning for example, which at least protects already-established users.
- mitchty 12y agoAdditionally, if you use gpg to build your ssh keys and have a trust/sign chain you could then pull this stuff with impunity as long as you keep the trust chain issues sorted.