Re: [Enigmail] jsunit updates and distribution

Werner Koch <[email protected]> Wed, 18 Sep 2019 19:54:51 +0200

Newsgroups	gmane.comp.mozilla.enigmail.general
Message-ID	<[email protected]>

On Wed, 18 Sep 2019 07:39, [email protected] said:

> But when it comes to commits, I don't warrant for anything. Some

You do not need to warrant anything but the fact that you did the commit
yourself on your box with your key.  It doesn't matter what you committed
or how long it took to get some feature finally done.  Signed commits
can be very helpful to assure that the commits origin from you and not
from some malicious hacker who grabbed you laptop at some point and
sneaked something in.  Or after large system compromises.

Obviously you should use a token for signing and carry that around
instead of your laptop.  It is easy to get used to that.  All it takes
is to have a key on a token (I suggest a Gnuk or Nitrokey Basic with an
Ed25519 key) and to have these kind of entries


--8<---------------cut here---------------start------------->8---
[user]
      name = "Werner Koch"
      email = "[email protected]"
      signingkey = C1D34B69219E4AEEC0BA1C21E3FDFF218E45B72B

[commit]
     gpgsign
--8<---------------cut here---------------end--------------->8---

in your ~/.gitconfig.  The signing step is really simple and you can
forget about it.  In particular because gpg-agent will ask you to insert
the token when needed.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

_______________________________________________
enigmail-users mailing list
[email protected]
To unsubscribe or make changes to your subscription click here:
https://admin.hostpoint.ch/mailman/listinfo/enigmail-users_enigmail.net

signature.asc (application/pgp-signature, 227 B)