71–80 of 100 posts
This is a great example of why you should enable vigilant mode [1] on your GitHub account and set your machine up to GPG sign your commits. [1] https://docs.github.com/en/github/authenticating-to-github/m...
But if you gpg sign your commit Now all your contributors will have to sign their next commits too. My workmates would hate me if i introduced this to production.
Earlier quoted context omitted.
But if you gpg sign your commit Now all your contributors will have to sign their next commits too. My workmates would hate me if i introduced this to production.
Why do they have to sign their commits? Their contributions are unverified, as are any commits made in your name without your signature, but they don't have to do anything. You gain the ability to prove that a certain commit came from your machine or someone with full access to it, they don't. To be honest, everyone should be signing their commits in a professional environment. It takes minutes of work to set up and…
Still need to be able to "push --force" on the remote repo for this to be useful, right?
It’s not just blame. GitHub uses commits to build the contributor list on your repo home page, so you can make it look like it has some famous contributors: https://github.com/jayphelps/git-blame-someone-else/graphs/c...
Oh man. I was thinking they'd probably patch that but ... how could they?
I assumed they were recording actions taken via the github UI and APIs, not the git commit log. If someone merges a pull request you opened, poof, you contributed the lines merged from that pull request regardless of the git author line. Same if you run `git push` with your github login credentials.
Apart from attributing things to the wrong person, git author line seems like it must also have the issue of not attributing things at all. What if I signed up with a different email address than I use for git?
Earlier quoted context omitted.
Oh man. I was thinking they'd probably patch that but ... how could they?
I'm actually shocked that's an issue. I assumed they were recording actions taken via the github UI and APIs, not the git commit log. If someone merges a pull request you opened, poof, you contributed the lines merged from that pull request regardless of the git author line. Same if you run `git push` with your github login credentials. Apart from attributing things to the wrong person, git author line seems like it…
This has saved me so many times. I’m sure I would have lost my job a while ago had I not been able to use this, it’s one of my most actively use tools. I’m sure eventually I’ll be losing my job, but at least this repo has enabled me to keep it a little bit longer.
Curious how do you get away with it without anyone noticing. Doesn’t this imply rewriting the master branch? Wouldn’t that cause noticeable issues for everyone else? Or maybe you’re the only active contributor on that codebase (but then who else can you blame?)
Earlier quoted context omitted.
This thought occurred to me, too. The example given is about pinning bad code on someone else, but the inverse is also possible: changing the author of good code to yourself. I'm kind of wondering, now, if there are some unscrupulous coders out there messing with their employer's internal git repos to give themselves credit for work other people did. I knew one guy who would create tickets, assign them to himself, an…
Well for one thing, the unscrupulous employee would need to have force push permissions to the origin repo. Even if they they did, once they change the history change, other developers working with the repo would be alerted of the remote branch changing out from under them next time they try to pull. And even if the change doesn't result in a conflict, and each of those other devs blindly accept the resulting merge,…
Have you ever seen that old video "The website is down"? [1]. In it, the guy covers his own tracks with admin privileges. I'm not saying it's easy, just that it's possible.