Git Commit Signing
The cluster focuses on using GPG, PGP, or SSH keys to sign Git commits for authenticity and security, debating their effectiveness against issues like unsigned commits, GitHub trust, and hash vulnerabilities.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Or, maybe you should gpg sign your commits. Then github is irrelevant, assuming you have sole control over your private key.
If you do not trust Github then signed commits will not help since Github physically controls the repository.
Having openpgp-signed commits would prevent such an issue.
Commit hashes are not a security feature but you can sign your commits with gpg.
Says it signs the commit with its own key. I guess you have to trust GitHub.
Usually you can sign your work in a cryptographically verifiable way https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
Git allows this. Github is just doing what it's told with the data it has. If you don't like this, ignore unsigned commits.
Git allows one to sign commits. It would be quite pointless if it was signing mere MD5 hashes.
So a git repo with signed commits ?
Signing my commits doesn’t prove that I didn’t do an unsigned one.