CODEWITHSUNDEEP
gitsecurityauthenticationversion-control
deldev
deldev

Reputation: 1376

How to ensure commit author

When I commit a code using git, I need to inform two global variables: user.name and user.email. However, I can put any email or information, inclusive other users or a invalid name or email. How git ensures this information?

Upvotes: 2

Views: 286

Answers (3)

jthill
jthill

Reputation: 60295

You can easily get the best available security over inbound commits, however, it isn't git's job to choose how you authenticate—git can't control OS authentication—only to allow you to plug in the security system you choose. Git hooks, in particular the pre-receive hook, are implemented to do just that. GPG is widely chosen for its flexibility, for offering total control over what identification standards to trust, for its universal availability, and for having survived fifteen years of security auditing.

(edit: furthermore, git distinguishes between author and committer; since the effects of a commit can be re-applied in other histories, the commit author can be held responsible for the original work, but if the changes are re-applied elsewhere only the person applying them can be held responsible for the fidelity.)

(wording, typo, links)

Upvotes: 2

talles
talles

Reputation: 15096

It doesn't, you just got to trust who is pushing.

There are some workarounds for it and respective downsides:

You can also make your own using a pre-receive or update hook

Upvotes: 2

eckes
eckes

Reputation: 67057

Git does not ensure anything at all. You could enter anything. The information is not used by Git, it just gets noted in the commits.

Upvotes: 0

Related Questions