• 0 Posts
  • 6 Comments
Joined 7 months ago
cake
Cake day: June 4th, 2024

help-circle
  • In my work organization, we don’t allow pushes from users that have not signed their commits. We also frequently make use of git blame along with git verify-commit. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We’re a medium-sized FinTech organization though, so it’s very important we keep track of who is touching what.

    That said, I can’t see it being all that important to an individual unless they’re very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and home-manager, I use the programs.git module to setup automatic signing and key selection. I really haven’t touched it at all in years now. It was very “set it and forget it” for me.