News for hackers. Stuff that matters.
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by hyperion2010 on Saturday September 05, 2020 @01:32PM (#24385323)
Any approach to sharing and collaborating around a git repository that requires some convention inside that repository seems fundamentally broken to me. I understand why people want to do it that way -- self describing artifacts are quite handy. Having something like fossil that can live inside a git repo itself is a big plus, for some workflows. I would be shocked if the linux kernel tree ever has a project.json file added to it. All the identifiers you need are already there in the commit hashes, why create another layer of complexity inside the repo itself?
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by justincormack on Saturday September 05, 2020 @01:50PM (#24385449)
It has signing information in it, which does seem necessary to authenticate commits.
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by nextaccountic on Saturday September 05, 2020 @05:24PM (#24386948)
but git itself has signed commits and tags.
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by justincormack on Saturday September 05, 2020 @05:59PM (#24387186)
Yes, but it does not tell you which signatures are valid in this repo, this is something that is external, eg GitHub lets you manage a list. You need this information to validate the signed commits.