Welp, there go my Git signatures

Re:Welp, there go my Git signatures by CaliforniaKarl on Tuesday October 24, 2017 @03:49PM (#15544653)

In our group's use case, we're not after the "implicitly-signed" property. We are trying to ensure that the person who is listed as doing the commit actually did the commit. We then have a server-side hook script, which ensures each new commit has been signed by a key kept in a local keyring.

[ Parent | on HN ]

Re:Welp, there go my Git signatures by hdhzy on Tuesday October 24, 2017 @04:20PM (#15544913)

Just out of curiosity do you somehow update the local keyring? So that one can update their key information (for example to add revocations and new keys).

[ Parent | on HN ]

Re:Welp, there go my Git signatures by CaliforniaKarl on Tuesday October 24, 2017 @05:43PM (#15545497)

There's a single-digit number of people who can update the local keyring. Which works right now, given that the number of people who push to the repos concerned is in the double-digit range.

Our PGP keys don't really change that often.

[ Parent | on HN ]