a long time ago i wrote https://github.com/rektide/git-ts , which posted git commit checksums to https://publictimestamp.org, which was a public service one could submit hashes to which would attest to them. hosted by linux foundation for a while. i really wish the website were still up to explain the project, even if it's offline. i loved having a way to say- yes, this commit is indeed from when it says it was.
there'a a ton of attestation stuff going on in cloud land these days, often under lofty objectives like "supply chain security".
longer term i'd like to see the git-of-git network emerge. forgefed federation makes exposing your hosts git services easy. then your peers can keep their own activity log of your system (perhaps even an ActivityPub stream for your main branches, a remote reflog sort of thing). to make it easier to see history being rewritten.
1 comment
[ 2.9 ms ] story [ 16.7 ms ] threadthere'a a ton of attestation stuff going on in cloud land these days, often under lofty objectives like "supply chain security".
longer term i'd like to see the git-of-git network emerge. forgefed federation makes exposing your hosts git services easy. then your peers can keep their own activity log of your system (perhaps even an ActivityPub stream for your main branches, a remote reflog sort of thing). to make it easier to see history being rewritten.