Why does Git need signed pushes?
git
Solution
Here is an excerpt from the commit message that introduced signed pushes:
While signed tags and commits assert that the objects thusly signed came from you, who signed these objects, there is not a good way to assert that you wanted to have a particular object at the tip of a particular branch. My signing v2.0.1 tag only means I want to call the version v2.0.1, and it does not mean I want to push it out to my 'master' branch---it is likely that I only want it in 'maint', so the signature on the object alone is insufficient.
The only assurance to you that 'maint' points at what I wanted to place there comes from your trust on the hosting site and my authentication with it, which cannot easily audited later.
So even though the commit is signed, you cannot be sure that the author intended that commit to be pushed to the branch `master` or to the branch `super-experimental-feature`. Signed pushes allow the server to keep a record of every push event and its signature. This log can then be verified to see that each commit was indeed intended to be on a particular branch.
Problem
In the release notes for Git 2.2.0, it describes a new option to `git push`, `--signed`: ``` "git push" learned "--signed" push, that allows a push (i.e. request to update the refs on the other side to point at a new history, together with the transmission of necessary objects) to be signed, so that it can be verified and audited, using the GPG signature of the person who pushed, that the tips of branches at a public repository really point the commits the pusher wanted to, without having to "trust" the server. ``` So it sounds like the data being sent to the server during the push is signed so that the server can verify and log who did the push. In the `man` pages you can confirm this: ``` --signed GPG-sign the push request to update refs on the receiving side, to allow it to be checked by the hooks and/or be logged. See git-receive-pack[1] for the details on the receiving end. ``` You look in the `man` pages for `git-receive-pack` under `pre-receive` and `post-recieve` hooks to see exactly how to verify a signed push. It seems like all of that helps the server verify who is doing the push really is who they say they are. How does `git push --signed` help you (the pusher) in not having to "trust" the server? Everything I have seen so far seems to indicate that it helps the server trust you. More importantly, Why are signed commits and signed tags not sufficient to push to an untrusted server? Why do we even need signed pushes?