Skip to content
Permalink
Browse files
Enjoy!
  • Loading branch information
@torvalds
torvalds committed Aug 4, 2015
0 parents commit 9b0562595cc479ac8696110cb0a2d33f8f2b7d29
Showing 1 changed file with 10 additions and 0 deletions.
10 README.md
@@ -0,0 +1,10 @@
Instructions on masquerading as other users in git:

```bash
export GIT_AUTHOR_NAME="Linus Torvalds"
export GIT_AUTHOR_EMAIL="torvalds@linux-foundation.org"
export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME"
export GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"
git commit -m "Enjoy!"
```

34 comments on commit 9b05625

@androm3da
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WOWOWOWOWW

@giacgbj
Copy link

@giacgbj giacgbj commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm GIT and I find it offensive. GIT IT?

@robotnoises
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm actually a wallaby

@uxcn
Copy link

@uxcn uxcn commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like github should probably distinguish between signed and non-signed commits.

@357r4bd
Copy link

@357r4bd 357r4bd commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

like duh

@hilios
Copy link

@hilios hilios commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

eat 💩

@paulanunda
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ヽ༼ຈل͜ຈ༽ﾉ

DONGLES

@stephen-mw
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sweet. He even signs off if you ask him nicely.

@crisdpa
Copy link

@crisdpa crisdpa commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't believe it

@BelfordZ
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wat

@gaapt
Copy link

@gaapt gaapt commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nothing to say

@warmwaffles
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

linus

@jomo
Copy link

@jomo jomo commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can do more fun things: jomo@c616eff

screenshot

@Davorak
Copy link

@Davorak Davorak commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use github's api to identify out who pushed a commit:

Currently the event in question is on page 3 so you can use:
https://api.github.com/repos/amoffat/masquerade/events?page=3

It i will roll to further pages as new events come in.

{
    "id": "3030685599",
    "type": "PushEvent",
    "actor": {
      "id": 259113,
      "login": "amoffat",
      "gravatar_id": "",
      "url": "https://api.github.com/users/amoffat",
      "avatar_url": "https://avatars.githubusercontent.com/u/259113?"
    },
    "repo": {
      "id": 40194425,
      "name": "amoffat/masquerade",
      "url": "https://api.github.com/repos/amoffat/masquerade"
    },
    "payload": {
      "push_id": 747582733,
      "size": 1,
      "distinct_size": 1,
      "ref": "refs/heads/master",
      "head": "9b0562595cc479ac8696110cb0a2d33f8f2b7d29",
      "before": "2ff8c2e08b0be167a6794a1a03b7a41f0c459141",
      "commits": [
        {
          "sha": "9b0562595cc479ac8696110cb0a2d33f8f2b7d29",
          "author": {
            "email": "torvalds@linux-foundation.org",
            "name": "Linus Torvalds"
          },
          "message": "Enjoy!",
          "distinct": true,
          "url": "https://api.github.com/repos/amoffat/masquerade/commits/9b0562595cc479ac8696110cb0a2d33f8f2b7d29"
        }
      ]
    },
    "public": true,
    "created_at": "2015-08-04T18:44:26Z"
  },

@psychocandy
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice.

@logicrime
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This kinda crap is why github is not an appropriate place for real-world projects, Security, enforcement and OPSEC at an all-time low across the board.

@formans
Copy link

@formans formans commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two billion dollars

@romi-h
Copy link

@romi-h romi-h commented on 9b05625 Aug 4, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

torvalds/linux#17

@andreyhsiao
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linus is gonna be mad 😃

@WhyNotHugo
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Davorak: Who pushed it doesn't reflect who authored or committed it anyway. Note that I can push a repo with commits done by anybody else.

@helloweishi
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

interesting, but no suprise, I believe it will be fixed soon.

@steakknife
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is equivalent to email spoofing. Another one of a multitude of reasons Github could support and verify GPG signed commits and tags, and permit repos to optionally reject unsigned commits.

@zenyr
Copy link

@zenyr zenyr commented on 9b05625 Aug 5, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 more reason for Linus for ditching/undermining Github

@lemenkov
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@steakknife honestly it seems that GitHub totally lost a momentum. A lot of features, and enhancements random people are constantly whining about (IPv6 for example) yet to be implemented. There is no visible issue tracker for that. It's just not possible to ask GH staff for anything technical. I'm afraid with @mojombo's retirement GitHub become stagnant. The only (and quite big btw) valuable asset left intact of GitHub is people but who knows for how long.

@mvasilkov
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Such clever.
Very hack.
Wow.

@Spaceghost
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wish everyone here would stop whinging and learn how to use gpg to sign tags (thusly history). https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

@paulRbr
Copy link

@paulRbr paulRbr commented on 9b05625 Aug 5, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Spaceghost me too. I don't understand why GitHub never pushed for that ?

@hugoroy
Copy link

@hugoroy hugoroy commented on 9b05625 Aug 5, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, the irony http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html (see why Linus thinks that GnuPG-signed commits are a bad idea)

@Spaceghost
Copy link

@Spaceghost Spaceghost commented on 9b05625 Aug 5, 2015 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Davorak
Copy link

@Davorak Davorak commented on 9b05625 Aug 5, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Davorak: Who pushed it doesn't reflect who authored or committed it anyway. Note that I can push a repo with commits done by anybody else.

@hobarrera - I was/am aware, my main point was unlike the the author of the commit, to my knowledge, it is not possible to spoof the login of the pusher given by the events api. So when using github and without additional signing a logical step is to hold those who push code to a repo responsible for any negative consequences regardless what the author information says, barring a some exceptions.

@arronmabrey
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

658

@graingert
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/blog/2144-gpg-signature-verification

@josephjoice
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just now I checked the https://github.com/torvalds/linux/commits/master and saw that even Linus is not signing his commits. Is it not a thing yet even after 1.5 years since Github started supporting signed commits?

@jomo
Copy link

@jomo jomo commented on 9b05625 Oct 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linus doesn't use GitHub, so he has probably never uploaded his key.

Signing commits has been also around for much longer (v1.7.9) than GitHub has added support for it.

Years before commit signing was possible, Linus said:

Btw, there's a final reason, and probably the really real one. Signingeach commit is totally stupid. It just means that you automate it, and youmake the signature worth less. It also doesn't add any real value, sincethe way the git DAG-chain of SHA1's work, you only ever need _one_signature to make all the commits reachable from that one be effectivelycovered by that one. So signing each commit is simply missing the point.

IOW, you don't ever have a reason to sign anythign but the "tip". Theonly exception is the "go back and re-sign", but that's the one thatrequires external signatures anyway.

So be happy with 'git tag -s'. It really is the right way.

Please sign in to comment.