Re:Git Files Hidden in Plain Sight
by woodruffw on Tuesday August 01, 2023 @02:20AM
(#36952938)
Nope, it’s the same. I believe the blog post is trying to say that including the key in the git object storage is effectively the same thing as self-signing, since there’s no independent key discovery or trust mechanism. In other words: it’s not because it’s a private key, but because putting a public key in the same channel that it’s meant to verify is essentially “useless” from a verification perspective.
[ Parent
| on HN ]
There are no comments on this comment yet.