News for hackers. Stuff that matters.
Re:Signing Git commits with your SSH key (2021) by shagie on Wednesday September 14, 2022 @12:28AM (#32833318)
> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rule...

And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there.

Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/[email protected]/admin/polic...

An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-r...

There are no comments on this comment yet.