This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
Add a comment |
2 Answers
GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23:
From: https://help.github.com/articles/about-gpg/
GitHub will automatically sign commits you make using the GitHub web interface. These commits will have a verified status on GitHub. You can verify the signature locally using the public key available at https://github.com/web-flow.gpg
To add to @Jonathan Cross's answer...
Signature rules
When will GitHub sign commits
- GitHub will sign commits made using the web UI
- GitHub will sign standard merges made using the web UI
- GitHub will sign commits made by squashing to merge using the web UI
When will GitHub not sign commits
- GitHub will not sign commits made by rebasing with the web UI
Why is a different key used than mine
This is because the web UI has no access to the private key, so it has to use its own key.
- Hi! Would you know why would GitHub not sign commits made by rebasing with the web UI?Jayant Bhawal– Jayant Bhawal2018-09-24 10:07:31 +00:00Commented Sep 24, 2018 at 10:07
- I do not know, my guess would be that it does not re-sign the commits after rebasing them as an oversight, rather than anything deliberatejrtapsell– jrtapsell2018-09-29 22:30:02 +00:00Commented Sep 29, 2018 at 22:30
- 11Very likely, because rebasing is affecting commits of a different author, and this could else be used to fake commits of other uses to appear as signedFlyingmana– Flyingmana2018-10-05 14:25:58 +00:00Commented Oct 5, 2018 at 14:25