Hacker News new | ask | show | jobs
by IanCal 2066 days ago
Do signed commits solve the integrity problem?
1 comments

Yes. Git commits include the hash of the previous commit, creating a cryptographic chain. If you can verify the signature at the tip of a branch you effectively verify the complete history of the branch.

Sadly not every maintainer signs their commits or tags.