Hacker News Reader

Comment by nerdponx | Hacker News Reader

> If we cared to, we could walk each commit all the way back to the beginning of Linux git history, but we don't need to do that — verifying the checksum of the latest commit is sufficient to provide us all the necessary assurances about the entire history of that tree.

Doesn't this imply a tremendous amount of trust in the signer? It sounds like it's only a guarantee about history if every commit was signed.

View on HN

It's not a matter of trusting the signer. Every commit includes the hash of its parent, and thus the combined hashes of all its ancestors. Signing just the last commits signs the entire chain.

Right... but where did the signer get the previous commits?

Oh, I see what you mean. But a signed commit doesn’t imply that the signer vouches for the code or it’s history (unless they say they do, but then you have to believe them that they reviewed the entire history). What it does do is to guarantee that after a commit is signed, nobody can come in and retroactively alter the history of the repo.

That's true. I guess we were approaching worries from opposite ends.

* Did it make it to the signer intact?

* Did it make it from the signer the signer intact?

And a single signed commit is good for the second question and only (which is still a big step up from no signatures!)

What if there are 5 unsigned consecutive commits somewhere in the middle of the chain? Or is the idea that you still can't alter anything in that unsigned section without altering the signed commits at the ends?

Yes, that’s exactly the idea

Reply on news.ycombinator.com