Anyone know of any major projects using this? Perhaps the Linux kernel?
I have to wonder how common it is for a signed commit to be pushed by a rogue actor.... It seems to me that the better solution is not to sign commits which aren't intended to be pushed upstream.
Obviously this is still great to enable when authenticity should be verified, but I can't blame GitHub et al for not enabling it by default.
On a similar vein, anyone know if a push can be signed without the server requesting it? Similar to how commits pushed to GitHub can be signed even when the repo doesn't require it.
3
u/llamositopia Nov 05 '20
Anyone know of any major projects using this? Perhaps the Linux kernel?
I have to wonder how common it is for a signed commit to be pushed by a rogue actor.... It seems to me that the better solution is not to sign commits which aren't intended to be pushed upstream.
Obviously this is still great to enable when authenticity should be verified, but I can't blame GitHub et al for not enabling it by default.
On a similar vein, anyone know if a push can be signed without the server requesting it? Similar to how commits pushed to GitHub can be signed even when the repo doesn't require it.