Re: [mantisbt-dev] Please use git commit -sS and git tag -s from now on

[John R. <jo...@no...>]

On Sat, Jun 9, 2012 at 12:32 PM, Robert Munteanu
<rob...@gm...> wrote:
> Skipping the fact that some IDEs ( Eclipse for sure, not sure about
> others ) don't support signed commits, what is the benefit we're
> looking for?

I believe the point is to mitigate the possibilities of central
repositories being maliciously modified.  By signing every commit, not
only can you verify the integrity of the repository and its contents
based on the SHA1 hashes, but you can also verify the legitimacy (or
trustability) of the content for any signed commit by validating the
GPG signature.

Of course, all of this hinges on the safety of the developers' GPG
keys.  Ie, if a dev's GPG key is compromised, then you are still left
with a problem of trusting the contents at face value, but it's still
"better" than having no trust indicators at all.

-- 
John Reese
noswap.com