Git Magazine History

Question

One thing that is important in version control is knowing who made what changes. If something changed, and I had no idea why the change was made, I would look into the history and ask the person who made the change. Since I'm learning git, one thing that makes me a little nervous about this feature is that it seems to be a very simple fake. What prevents me from putting the employee name / email in the global git configuration for user.name and user.email? When using something like gitosis / gitolite (which defined users) or github (which I suppose to use something like gitosis / gitolite), is there any wyy to see who actually made the commit?

Answer 1

Gitolite logs (in .gitolite/logs/gitolite-* ) by Gitolite for each click. There is a bit more work to determine the push that introduced a specific commit, but it should be straightforward (one way: discard light tags at the end of each click, and then use git name-rev to find the first tag after the commit).

Most Gitolite users may have only one SSH key associated with them ( keydir/user.pub ), but one user can have multiple SSH keys ( keydir/ user@ *.pub ).

So, for SSH-based Gitolite, you can map each commit to one (or more) SSH keys.

If you trust an SSH key to accurately identify a specific person, this is another question (i.e. do you trust users to keep their SSH private keys?).

Gitolit can also mitigate Git access to intelligent HTTP. In this case, the web server supplies the Gitolite username in the REMOTE_USER environment variable (i.e. instead of using the .ssh/authorized_keys file to identify the user based on the SSH key). Authentication and authentication are fully consistent with the web server itself (usually it’s just a username and password, but SSL certificates for each user can be used to make something more like SSH access).

So, for HTTP-based Gitolite, you can map each commit to the authentication performed by the web server.

---

GitHub has some similar information and can be requested through the Events part of the GitHub API (previously it was only available as part of the "Newsfeed" entries for your observed repositories). Each PushEvent identifies the GitHub user who performed the push, the name ref (branch) was updated, the name (SHA1 hash), the new ref-head (new tip of the updated branch), and the list of commits.

Answer 2

This is not a forum on ethics or philosophy, afayk; BUT

git allows you to sign signed and signed tags. This should help you feed your paranoia :)

Answer 3

You can get everyone to sign up with GPG: see this guide .

In the tutorial, the GPG passphrase is set to the git configuration, which seems pointless to me, so you want the hook request to prompt the user for each commit.

Of course, if you are not a manager, suggesting that everyone sign their obligations, they can be diplomatically tough, so be careful.

EDIT: As Brian notes, this only signs a commit message, so this is not a good solution . I keep the answer, as it can still help to understand the problem.