News for hackers. Stuff that matters.

A comment on Radicle-Link: Extending Git with Peer-to-Peer Network Discovery. Parent comment

Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by justincormack on Saturday September 05, 2020 @01:50PM (#24385449)
It has signing information in it, which does seem necessary to authenticate commits.
[ Parent | on HN ]
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by nextaccountic on Saturday September 05, 2020 @05:24PM (#24386948)
but git itself has signed commits and tags.
[ Parent | on HN ]
Re:Radicle-Link: Extending Git with Peer-to-Peer Network Dis... by justincormack on Saturday September 05, 2020 @05:59PM (#24387186)
Yes, but it does not tell you which signatures are valid in this repo, this is something that is external, eg GitHub lets you manage a list. You need this information to validate the signed commits.
[ Parent | on HN ]