Re:Unsigned Commits
by JackSlateur on Thursday January 25, 2024 @08:13AM
(#39129209)
It’s worth noting that only GitHub will do this, since they are the root of trust for this signing scheme.
This is wrong : the commit signature is stored inside git:
commit 96afe9a2af7d72fbd6cd790143388c47d9f91d3e (HEAD)
gpg: Signature made Thu 28 Sep 2023 10:12:38 AM CEST
gpg: using RSA key 653A3D280EB42CB78CF327CFEDDED470D80A522C
gpg: Good signature from "Jack <[email protected]>" [ultimate]
Author: Jack <[email protected]>
Date: Wed Sep 27 10:00:24 2023 +0200
commit message
The author seems to miss a lot of git internals : the name and email in the commit message are nothing but text, everybody can write anything. The one who wrote a commit may not be the one who push the commit in github (or in any kind of remote). But reading the "pro/con" at the end of the article should be enough to throw the whole things away :/
This is wrong : the commit signature is stored inside git:
The author seems to miss a lot of git internals : the name and email in the commit message are nothing but text, everybody can write anything. The one who wrote a commit may not be the one who push the commit in github (or in any kind of remote). But reading the "pro/con" at the end of the article should be enough to throw the whole things away :/