11–20 of 185 posts
It seems that one proper solution could be: 1 - Don't associate the commit to an account if the email is unverified, obviously 2 - If someone tries to "forge" ownership by pushing a commit with an e-mail that doesn't belong to the GitHub account being used to push, a "unverified" warning should be added to the commit and manually claimed by the account owning said e-mail for its status to change.
I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…
GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that…
Arpad, your site looks like this - https://i.imgur.com/jj9Uxbl.png Not just the linked page, the homepage too. All but illegible. That's in a recent Firefox on Windows. Just FYI.
This is just a fact of how attribution works in Git. It's not GitHub's responsibility to figure out exactly who should be given credit for which commit, they're just a viewer on top of Git commits. Imagine you did some work at some workplace years ago, and you want credit for it. You don't have access to that email anymore, but you'd still like to have the credit and have it link to your account. That's the usecase.
If it's not GitHub's responsibility, then why are they doing it? Nobody forces GitHub to attribute commits to GitHub user accounts. (And yes, you answer this "why" question in your next sentence, I'm just pointing out that your argument is nonsensical.)
Arpad, your site looks like this - https://i.imgur.com/jj9Uxbl.png Not just the linked page, the homepage too. All but illegible. That's in a recent Firefox on Windows. Just FYI.
Firefox 97.0.1
Linux version 5.16.11 (gcc 10.3.0, GNU Binutils 2.35.2)At the very least, repo owners should have some better control over how attributions display when the user is not a project member or the email used is not verified to an existing user.
I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…
You could just run a script which rewrites the email address in all the git commits, and force-push the revised version.
It’s old news.