First result of a search:
Gitorious was a free and open source web application for hosting collaborative free and open-source software development projects using Git revision control. Although it was freely available to be downloaded and installed, it was written primarily as the basis for the Gitorious shared web hosting service at gitorious.org, until it was acquired by GitLab in 2015.
In my work organization, we don’t allow pushes from users that have not signed their commits. We also frequently make use of
git blame
along withgit verify-commit
. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We’re a medium-sized FinTech organization though, so it’s very important we keep track of who is touching what.That said, I can’t see it being all that important to an individual unless they’re very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and
home-manager
, I use theprograms.git
module to setup automatic signing and key selection. I really haven’t touched it at all in years now. It was very “set it and forget it” for me.