前言
Git commit 偽造攻擊
https://github.com/aguerrero/Faking-Git-Commits
Git 本身并沒有檢查是誰提交的commit。 提交者可以在提交時提供author 和email 信息
git commit --author="Linus Torvalds torvalds@linux-foundation.org" -m "Change grade"
這樣睦裳，就可以在自己的repo 里偽造一個commit， 看起來是Linus Torvalds 提交的原献。
當然這可能并不能起到什么攻擊馏慨，因為只能將commit push 到自己的repo 中。
但在github 這種開源環(huán)境中姑隅， 很容易造成混亂熏纯。
Consider the average CS student that will be searching for jobs after graduation. Such a student may be building a portfolio to present to possible employers, but may not have anything on GitHub that catches too much attention. One way to change that could be to fake some commits from some high profile programmers like Linus Torvalds. Having some commits from Linus may get your project some attention and make people assume you are a better programmer than you really are. After all, if your project was bad, there would be no way Linus would have looked at it and contributed in the first place.
Git 本身提供了使用GPG https://en.wikipedia.org/wiki/GNU_Privacy_Guard 來簽名的方式。
Github 上提供了非常完善的說明: https://help.github.com/categories/gpg/
配置好后粤策，就可以在Github 上顯示為 Verified。
是不是會更酷一點误窖？
如果GPG 的key 對應的email 和commit 的email 不同叮盘， github 會把GPG的key 顯示為“unverified”霹俺。 可以給該
GPGkey 增加 email柔吼。 https://www.ahmadnassri.com/blog/github-gpg-keybase-pgp/
GPG 不光可以用戶簽名git commit， 還可以用來簽名郵件丙唧，以及加密等愈魏。
