git - 为什么 Git 需要签名推送？

Question

在 Git 2.2.0 的发行说明中，它描述了 git push 的新选项，--signed:

"git push" learned "--signed" push, that allows a push (i.e.
request to update the refs on the other side to point at a new
history, together with the transmission of necessary objects) to be
signed, so that it can be verified and audited, using the GPG
signature of the person who pushed, that the tips of branches at a
public repository really point the commits the pusher wanted to,
without having to "trust" the server.

所以这听起来像是在推送期间发送到服务器的数据已签名，以便服务器可以验证并记录谁进行了推送。在man pages你可以确认这一点:

--signed
   GPG-sign the push request to update refs on the receiving side, 
   to allow it to be checked by the hooks and/or be logged. See 
   git-receive-pack[1] for the details on the receiving end.

你看man pages for git-receive-pack在 pre-receive 和 post-recieve Hook 下可以确切地了解如何验证已签名的推送。

似乎所有这些都有助于服务器验证谁在进行推送确实是他们所说的。

git push --signed 如何帮助您(推送者)不必“信任”服务器？到目前为止，我所看到的一切似乎都表明它有助于服务器信任您。更重要的是，为什么签名提交和签名标签不足以推送到不受信任的服务器？为什么我们甚至需要签名推送？

Answer 1

这是 commit message 的摘录引入签名推送:

While signed tags and commits assert that the objects thusly signed came from you, who signed these objects, there is not a good way to assert that you wanted to have a particular object at the tip of a particular branch. My signing v2.0.1 tag only means I want to call the version v2.0.1, and it does not mean I want to push it out to my 'master' branch---it is likely that I only want it in 'maint', so the signature on the object alone is insufficient.

The only assurance to you that 'maint' points at what I wanted to place there comes from your trust on the hosting site and my authentication with it, which cannot easily audited later.

因此，即使提交已签名，您也无法确定作者是否打算将该提交推送到分支 master 或分支 super-experimental-feature。签名推送允许服务器保留每个推送事件及其签名的记录。然后可以验证此日志以查看每个提交确实打算在特定分支上进行。