[whitepirate20]

This is nice. At my company, some “bad actors” were pushing commits to git repositories that impersonated a bunch of employees at the company to repos that were essentially targeted hate crimes. I definitely recommend something like this.

[wyldfire]

Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

Also note that until you can individually get the good actors' public key you can't verify their commits. So it's not enough to distribute the instructions in this webpage, you also have to have a trusted key exchange. Everyone who wants to verify commits will need a copy of everyone who might sign commits' public keys.

If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.

[shagie]

> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rule...

And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there.

Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/polic...

An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-r...

[echohack5]

> If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.

Additionally you can enable "Vigilant Mode" to make it obvious when commits are untrusted.

https://github.blog/changelog/2021-04-28-flag-unsigned-commi...

[nonethewiser]

Commits such as?

[wyldfire]

    commit 3c2f202543b31e9d7e2fff92a211a0f37ebcca9b (HEAD -> master)
    Author: Dave <[e-mail]>
    Date:   Tue Sep 13 21:32:41 2022 -0500

        I am not smart.

[whitepirate20]

Just code contributions to some trans hating repo or something, don’t remember the details.

[nukemandan]

https://github.com/jayphelps/git-blame-someone-else