Hi, On Wed, Nov 02, 2011 at 10:11:26AM +0100, Ingo Molnar wrote: > If this approach is used then it would be nice to have a .gitconfig > switch to require trusted pulls by default: to not allow doing > non-signed or untrusted pulls accidentally, or for Git to warn in a > visible, hard to miss way if there's a non-signed pull. > > This adds social uncertainty (and an element of a silent alarm) to a > realistic attack: the attacker wouldnt know exactly how the puller > checks signed pull requests, it's kept private. But that way you get a false sense of alarm when someone sent a perfectly trustable pull request, e.g. by signed email. Another question: If store the actual pgp/gpg signatures in the git tree, how do you handle signatures by keys which were valid by the time the signature was made but expired when checking some time afterwards? AFAICT, gpg will only tell you the key is expired _now_, and will make no statement regarding the time the actual signature was made. Thanks, Jochen. -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html