What mistake or threat does the signing of the decision make?

Question

We use GitHub and we have a request to commit commit . Having studied the process, I do not understand what fixation fixation problem solves. As far as I understand, the “local source code” process, which is tied to the “local repo”, gets into the “remote repo”. Thus, there are three fields and two arrows that create a directed graph from the local source files to the remote repository. For the end user, the threads are reversed.

In the model, as described, it seems that we want permissions to be executed when a remote repo is clicked; and capturing signatures is of little use.

SCM Git User Guide 7.4 Git Tools - Signing your work does not indicate a problem that it solves. However, he says that I am hunting for the answer:

Everyone must subscribe

Signing tags and commits is great, but if you decide to use this in your normal workflow, you need to make sure everyone on your team understands how to do it. If you do not, you will end up spending a lot of time helping people understand how to rewrite their obligations with signed versions. Make sure you understand the GPG and the benefits of signing things before accepting this as part of your standard workflow.

I assume that Git engineers modeled Git workflows. They identified the problem (or problems), and they put “label control” on security control to fix it. I would like to know what problems they identified and solved using the “fixation fixation”.

I think what happened is that people confuse / associate Authentication with authorization, or possibly code integrity. Unfortunately, authentication is not authorization or code integrity, despite being willing to do so.

What problem does git capturing commit?

Answer 1

The problem of resolving a signature is the same problem as digitally signing a document: the problem of verifying its author.

Since only the author has his own private key, only they can sign commit as themselves.

If I trust a specific committer, and they signed their commit, I can trust their code without having to check each line with each hand.

---

Consider the case when someone forked your repository on github, and then added a bunch of commits that introduced vulnerabilities into your code. They committed these commits with the tuple author name, author email, commit name, commit email , set by one of the original authors.

Without signing a commit, there is no way to verify that they are not the original author.

When commit commit, these fake commits cannot be signed because the forger does not have the author’s private key.