Search code examples
gitcommitauthor

How to prevent author of Git commit from being changed


I want to make distinct users for my Git commits. For example, now we have 5 systems installed with Git. But while committing a change into Git remote repository, I can change my default author name and email in commit window.

How can I make it so they cannot be changed?


Solution

  • Your Git repository is yours. You can do anything you want to it. No one else can stop you, and you cannot stop anyone else from doing anything they want to their repositories.

    In short, there is nothing—literally nothing—you can to do prevent someone else from claiming to be you, or to prevent yourself from claiming to be someone else. This is the same problem a bank ATM has. In order to make sure you are you, and Fred is Fred, and so on, you must step outside the problem itself and look to authentication. If someone claims to be Fred, how do you know whether he is or is not Fred? Especially, how can you tell whether he's really Fred if you've never met him before? He might be Ravi, or Binyamin, or Jürgen!

    If you and Fred have a shared secret, or some other way of deciding whether to believe him, you can use that. And that's all you can do: decide, at the time you are obtaining some set of commits from someone, whether or not you believe them when they tell you they're Fred.

    Git has GPG signature verification built in, to some extent (it does not do the GPG signature stuff itself, it relies on third-party software). You can sign individual commits, or sign an annotated tag. For a bunch of good reasons, signing individual commits is usually more cost than benefit. Git commits form a Merkle Tree, so checking the signature of an annotated tag provides a reasonable level of assurance about the commits reachable from that tag. (The amount of protection, however, is not much greater than that of SHA-1.) See also GPG.