Hacker News new | past | comments | ask | show | jobs | submit login

> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rule...

And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there.

Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/polic...

An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-r...




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: