GIT author authentication

2019-08-06 03:24发布

问题:

Our company is looking into modernize our version control and generally we would like to use git. I've use distributed version control before but only with personal project and opensource project (where there is some sort of user management) (Mercurial on Google code and Bazaar on LaunchPad). I am not sure about how can we authenticate author of each commit if we are using GIT on our own repository. I am not talking about the authentication for push but for commit.

So let say .. 1. I clone the repo and check out a branch. 2. I change my user.name to my worker and make changes and finally commit. 3. I change my user.name back and push (with my ssh account for example). 4. There I can blame all the changes to my coworker.

Will this be a problem? How do we get around to tame this problem?

I am sure there is something out there but I guess I am not looking for the right info so it would be very helpful if you guys can give me some basic overview on this.

Thanks

回答1:

You cannot regulate the creation of commits, since that happens on each user's workstation, in their own local copy of the repository.

You can do some checks (with hooks) in the central repository, and require that incoming commits bear the name of the connecting user. However, this is a bad idea.

Consider the case where one user might need to reuse someone else's work, but doesn't want to merge it. He might cherry-pick someone else's commit, or rebase their branch onto his own. In this case, it is correct that the authorship information match the original commits, and restricting incoming commits to have an author name that matches the user pushing them would break this workflow.

I would worry about this only if it becomes a problem. It comes down to trust: if you don't trust a developer, why do they work for you?



标签: git security