-
Notifications
You must be signed in to change notification settings - Fork 69
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Recommend using GPG signed commits vs. --signoff #79
Comments
I agree with that 👍 |
Yes please. I use GPG and have not seen any problems. It has been frustrating seeing commits fail for this project due to this requirement. |
Looking into this a bit further, the I think this issue should be closed, but will leave it open for a bit so folks can catch up. -- Lance Ball 12:27 PM 1 reply dug 12:28 PM Lance Ball 12:28 PM dug 12:31 PM Lance Ball 12:34 PM dug 12:37 PM Lance Ball 12:41 PM dug 12:42 PM Lance Ball 12:42 PM dug 12:43 PM Lance Ball 12:43 PM dug 12:46 PM Lance Ball 12:46 PM |
Closing this issue since it seems at best we could add GPG signed commits as a requirement and I'm not sure I want to do that. |
The
--signoff
flag for commits is not often used and is primarily a declaration that the committer has actually authored the code or has rights to submit code she has not written. Instead, I think it's better to use cryptographically signed commits which can also be enforced by GitHub (see protected branches in settings). Using GPG signatures on commits is generally a better way to ensure that a commit is coming from the person it appears to be coming from, vs.--signoff
which is just a line of text at the bottom of a commit message. By using GPG signed commits, there is much more certainty that the commit is legitimate and coming from the person it appears to be coming from.The text was updated successfully, but these errors were encountered: