{"version":"https://jsonfeed.org/version/1.1","title":"Vic Demuzere - Git","home_page_url":"https://vic.demuzere.be/articles/tags/git/","feed_url":"https://vic.demuzere.be/articles/tags/git/feed.json","description":"Blog posts tagged Git by Vic Demuzere","language":"en","items":[{"id":"https://vic.demuzere.be/articles/cryptographically-signing-git-commits-tags/","content_html":"

Git lists the author of every commit ever made to a repository.\nThis comes in quite handy, but is easy to fake.\nAuthor data is simply read from the configuration file without any validation.\nThis means you could easily commit to an (open source) repository and pretend to be me.

\n
git config --global user.name "Your Name"\ngit config --global user.email you@example.com\n
\n

The author data is especially important when something goes wrong.\nImagine a certain commit caused a security issue, or broke software in a way that should have been caught by tests.\nWho made this change?\nIt is clear that we shouldn't trust the author listed by git log in this case.

\n

Tags have partially solved this issue by allowing you to PGP sign them.\nAs the git commit hash includes the parent hash, this signature validates the complete history up to that specific tag.\nThe PGP signature is made by your personal key and is harder to fake.

\n

Tags with a signature

\n

Creating a signed tag is easy once you have set up your private key in GnuPG.\nExecute the tag command with the -s flag to sign the tag as you create it.

\n
git tag -s <name>\n
\n

Git should be able to automatically find your PGP key based on the e-mail address you've listed in the user.email setting.\nIn case you don't want git to figure this out, it is also possible to set a default signing key globally:

\n
git config --global user.signingkey 1234ABCD\n
\n

That's it! Now your tag is signed. This moves the problem but doesn't actually solve it.\nSigned tags allow you to declare that you have checked the commit log and verified that it wasn't tampered with.\nIt is now possible to verify the tag using git tag -v.\nThis works fine for small projects and teams with only a few developers.\nBut what if you're managing something bigger?

\n

Your initial problem remains: How do you know for sure who changed your code?\nThe real solution is obvious...

\n

Signing every commit

\n

Git v1.7.9 introduced the ability to cryptographically sign commits, similar to how it works with tags.\nThe difference here is that the shortcode is uppercase -S as the lowercase flag is used for the Signed-off-by field already.\nOther than that, usage is pretty much the same.

\n
git commit -am "Fixed something somewhere" -S 1234ABCD\n
\n

There is quite a bit discussion about whether it is useful to sign every commit.\nLinus Torvalds explained why he thinks signing commits is a bad idea on a mailing list several years ago.\nThe most important part is quoted below, but you should really read the whole message to get the full picture:

\n
\n

Signing each commit is totally stupid.\nIt just means that you automate it, and you make the signature worth less.\nIt also doesn't add any real value, since the way the git DAG-chain of SHA1's work, you only ever need one signature to make all the commits reachable from that one be effectively covered by that one.\nSo signing each commit is simply missing the point.

\n
\n

Git doesn't provide a way to automatically sign every commit, although you could use a bash alias or something similar to make signing semi-automatic.

\n

Update: Since Git 2.0 it is possible to configure Git to sign all your commits using the commit.gpgsign option.

\n

Thanks for subscribing to my feed!

Feel free to e-mail comments or corrections to vic@demuzere.be.

","url":"https://vic.demuzere.be/articles/cryptographically-signing-git-commits-tags/","date_published":"2015-03-22T11:50:50Z","date_modified":"2025-03-28T08:56:26Z","language":"en"},{"id":"https://vic.demuzere.be/articles/git-cheatsheet/","content_html":"

This article contains a few useful git commands.

\n

Gui tools

\n

Open the built-in graphical tool for commits (requires tk):

\n
git gui\n
\n

Start a local webserver to browse the repository, open in chromium:\n(Requires lighttpd)

\n
git instaweb -b chromium\n
\n

Local repository

\n

Create a new repository in the current directory:

\n
git init\n
\n

Add a new file to the repository:

\n
git add <file>\n
\n

Commit all pending changes:

\n
git commit -am <message>\n
\n

Remotes

\n

View all remotes linked to from this repository:

\n
git remote\n
\n

Add a new remote

\n
git remote add <name> <url>\n
\n

Remove a remote

\n
git remote rm <name>\n
\n

Push local changes to a remote

\n
git push <remote>\n
\n

Push local tags to a remote

\n
git push --tags <remote>\n
\n

Pull changes from a remote

\n
git pull <remote>\n
\n

Tags

\n

Create a signed tag (Requires a PGP key)

\n
git tag -s <name>\n
\n

Verify a signed tag

\n
git tag -v <name>\n
\n

Branches

\n

Remove a remote branch

\n
git push <remote> :<branch>\n
\n

Thanks for subscribing to my feed!

Feel free to e-mail comments or corrections to vic@demuzere.be.

","url":"https://vic.demuzere.be/articles/git-cheatsheet/","date_published":"2012-02-09T18:00:00Z","date_modified":"2023-11-28T19:55:32Z","language":"en"}]}