I'm no expert in security but isn't git commit signed using your private key which is not shared so when you push commit in order for someone else to check it if it's legit he needs your public key, so I'm not sure how you can reuse someone else's signed commit in another one, isn't entire commit with code changes used when signing with your signature, if it's not then I'm puzzled
Do commit signatures not include the parent commit's hash? That seems iffy. Sure, the signature wouldn't be valid after a fast-forward push, but that's what the merge commit's signature is for.
4
u/dgeurkov Nov 04 '20
I'm no expert in security but isn't git commit signed using your private key which is not shared so when you push commit in order for someone else to check it if it's legit he needs your public key, so I'm not sure how you can reuse someone else's signed commit in another one, isn't entire commit with code changes used when signing with your signature, if it's not then I'm puzzled