'I understand this feature has the benefits of allowing people to push commits with emails they don’t own, such as ‘example@example.com’ that I occasionally use, but having your commits attributed to a different user is a whole different issue.'
More than that it makes it so the distributed nature of Git is preserved. If I pull from someone who committed a bunch of stuff under their own name but isn't a user on GitHub, then push up to GitHub, GitHub won't be able to just reject the commits from the user who is not on GitHub - it will have to reject the push entirely. Thus, there is no way around this without losing all the benefits of Git.
Perhaps a way around it would be to sign all commits where the committer has the same email address as an existing GitHub user, and then check the signature against the GitHubber's known key, and reject it if the signature doesn't check out.
But having to sign commits if you are a GitHub user adds extra hasssle, and what if an unsigned commit accidentally makes its way into the history? What a pain. Everyone would always have to commit with the possibility of being able to be pushed up to GitHub in mind.
Comments
'I understand this feature has the benefits of allowing people to push commits with emails they don’t own, such as ‘example@example.com’ that I occasionally use, but having your commits attributed to a different user is a whole different issue.'
More than that it makes it so the distributed nature of Git is preserved. If I pull from someone who committed a bunch of stuff under their own name but isn't a user on GitHub, then push up to GitHub, GitHub won't be able to just reject the commits from the user who is not on GitHub - it will have to reject the push entirely. Thus, there is no way around this without losing all the benefits of Git.
Perhaps a way around it would be to sign all commits where the committer has the same email address as an existing GitHub user, and then check the signature against the GitHubber's known key, and reject it if the signature doesn't check out.
But having to sign commits if you are a GitHub user adds extra hasssle, and what if an unsigned commit accidentally makes its way into the history? What a pain. Everyone would always have to commit with the possibility of being able to be pushed up to GitHub in mind.