What does a PGP signature on a Git commit prove?

Re:What does a PGP signature on a Git commit prove? by phs318u on Tuesday March 30, 2021 @11:36PM (#26643240)

That the committer hopes you believe they manage their PGP private key better than they manage their Git account security?

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by shawabawa3 on Wednesday March 31, 2021 @03:35AM (#26644463)

You know anyone can push a commit "authored" by any GitHub user? And the GitHub UI will happily show as that user

Gpg signature's are the only way of having any verification at all on who wrote a commit

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by bawolff on Wednesday March 31, 2021 @01:36AM (#26643866)

Git doesn't have accounts. Its a program you run on your computer.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by asguy on Tuesday March 30, 2021 @11:40PM (#26643271)

Which “git account”? Signing means you don’t need to depend on the git mirrors security to ensure you know who made a commit.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by phs318u on Wednesday March 31, 2021 @07:29PM (#26654573)

To the above commenters, Git is also used in enterprise scenarios with private, semi-private repos that enforce corporate user auth.

My initial comment was dumb and deserved downvotes, but all git usage isn't the git usage you know of.

[ Parent | on HN ]