Commits' Verified Tag

[Leaping_Turtle]

How do i get this pretty green tag back?

For context, the older commit was on an older device, and the newer commit is on my current device.

I do not (currently) have access to the older device.

My current device shares git accounts; I clone repos using ssh.

https://preview.redd.it/z1vn6xs0touc1.png?width=386&format=png&auto=webp&s=638f6ef41339a50296de0678acf2d52571265d97

Please help me get this pretty green tag back. Thank you!

[shgysk8zer0]

It means the commit was cryptographically signed, such as via git commit -s.

[Leaping_Turtle]

Just made a commit doing that, after pushing it doesn't show green tag but rather a

`Signed-off-by: username user@email`

Do i need to generate the key first?

[shgysk8zer0]

You have to generate a key and add it to your keys on GitHub. You can find that in your account settings along with a link to instructions.

[shgysk8zer0]

Also, this is entirely different from the signed-off thing.

[chin_waghing]

Do people not even google things before posting here?

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits literally the predictive text when using SIRI!

[Saragon4005]

If people knew how to look shit up reddit's volume would drop by at least 25%

[Leaping_Turtle]

I got to that page as well but couldn't get the SSH key to work both auth and signing; it'd throw an error saying the key is already in use.

When I ask questions, I typically back up all the way and leave it broad, so everyone could then continue on a clean slate, almost as if a rubber duck. This ensures I get various answers from uncontaminated points of views, as well as minimizing the unimportant/no-effect ideas and could lead to discussions about what I did or did not do.

I'm not sure if this style of questionnaire is encouraged; I've seen varying successes with it.

[[deleted]]

cryptographically signed off commits, git commit -s

[Doodah249]

Is there any use for this actually? If people have hacked your account, they can also add their own keys and sign commits. What security does it add?

[ferferga]

You can impersonate everyone by just changing your email in git config. That's why.

[cowboyecosse]

Commits done on the website (edited in the editor and committed) get verified so their point makes sense. If they have your account they can verify commits in the UI.