Post #1579429
2026-04-22 19:41 UTC
@phildini I still sign my tags, but not commits, mostly because I want the ability to treat SSH keys/machines as ephemeral, and don't want to deal with unlocking my keychain for every single commit. IMO it's the final "release artifact" that matters more than the incremental work.
Replies (1)
-
@glyph@mastodon.social 2026-04-22 20:03
@amethyst @phildini I still stand by everything in https://blog.glyph.im/2024/01/unsigned-commits.html and have never signed a commit on purpose, release artifacts included. nobody has ever asked me to either, as far as I can recall.