Ignite – Konstantin Ryabitsev
summary
Explains why PGP is valuable for code signing not email and shows how signed git tags and commits prove a repository is byte‑for‑byte unchanged: use git tag -s to sign a release (example: curl 2011 where signed tags defended the tree) and git commit -S to mark author identity; warns keys must be protected (store master offline and use a hardware token), describes how signatures cover the whole history via parent hashes, and points to a step‑by‑step guide with commands and best practices.
AI-written summary · about
related talks
30mPractical (and impractical) git commit signing
34mSafe and Signed Git Commits with PGP
29mIdentity-based Source Integrity with Gitsign
30mWhat is this PGP thing, and how can I use it?
37mGitsign – Keyless Git Commit Signing
06mKeynote: Signing Git Commits with Gitsign
49mProtect Your Code with GitHub Security Features
38mSecuring Git Repositories with Gittuf