Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis...
by hyperion2010 on Saturday September 05, 2020 @01:32PM
(#24385323)
Any approach to sharing and collaborating around a git repository that requires some convention inside that repository seems fundamentally broken to me. I understand why people want to do it that way -- self describing artifacts are quite handy. Having something like fossil that can live inside a git repo itself is a big plus, for some workflows. I would be shocked if the linux kernel tree ever has a project.json file added to it. All the identifiers you need are already there in the commit hashes, why create another layer of complexity inside the repo itself?
[ Parent
| on HN ]
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis...
by justincormack on Saturday September 05, 2020 @01:50PM
(#24385449)
It has signing information in it, which does seem necessary to authenticate commits.
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis...
by nextaccountic on Saturday September 05, 2020 @05:24PM
(#24386948)
but git itself has signed commits and tags.
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis...
by justincormack on Saturday September 05, 2020 @05:59PM
(#24387186)
Yes, but it does not tell you which signatures are valid in this repo, this is something that is external, eg GitHub lets you manage a list. You need this information to validate the signed commits.