community VS gitsign

Check out how to create your own or feel free to borrow from Community Discussions’ templates.

Although GitHub did not have a plan to support this option, but AzureDevops and GitLab already supported this. https://github.com/community/community/discussions/8940 You can manually do it for now

[4]: https://github.com/community/community/discussions/37117

I think it's not about missing commands, but missing destination (package repo of "generic" type). Very same issue posted here: https://github.com/community/community/discussions/38083

btw - I know this exists, but it seems like the posts are responded to much: https://github.com/community/community/discussions/categories/copilot

It appears that you're using IPv6 (your ping is returning IPv6 addresses). A quick search shows some github services may not support IPv6 but that's just a guess

Yeah, Vundle's (presumably temporary) removal caught me off guard today on a fresh install. This, in turn, has caused me to take a hard look at the Vim plugins I was using. Turns out I only needed one...which I wrote. So I'm now just storing that one in the horrible "vanilla" Vim plugin scheme and putting that in my dotfile management.

Just a good reminder that dependencies will always let you down. It's just a matter of time. Oh, and never turn your back on a big company.

Here's the tracking on this issue:

https://github.com/community/community/discussions/48173

GitHub: "The VundleVim organization has been flagged. Because of that, your organization is hidden from the public."

It's a relatively new beta feature for GitHub.

Here's the support discussion ticket for this:

https://github.com/community/community/discussions/48173

>The VundleVim organization has been flagged.

> does it also filter/escape ANSI Sequences in messages and author names?

Not at present! Do you have a link or so I could use to familiarize myself? I'm curious if it'd fall within gittuf's scope.

> does it block garbage collection?

Nope, it doesn't. That said, the repository will have more objects, gittuf tracks additional objects through custom refs in `refs/gittuf/`.

> how do you ensure that the developers are really the developers and there's no spoofing?

At present, gittuf policies use signing keys. It doesn't rely on the commit metadata for author and committer but rather the commit's signature. We support GPG and Sigstore's gitsign [0] right now, and we want to support other signing mechanisms like SSH keys as well.

[0] https://github.com/sigstore/gitsign

You may want to check out https://github.com/sigstore/gitsign! You can generate ephemeral x509 code signing certs for free using Sigstore.

(disclosure: I'm a maintainer for gitsign)

Def check out the gitsign project mentioned in the post: https://github.com/sigstore/gitsign

Gitsign offers a keyless commit signing implementation based on OIDC, which is an identity layer built on top of the OAuth 2.0 framework. Gitsign supports verifying your identity either through GitHub, Microsoft, or a Google account.

Shameless plug for the gitsign project in sigstore: https://github.com/sigstore/gitsign

This isn't supported by GitHub yet but we're hopefully working towards that too.

We used to actually run an RFC3161 timestamp server in addition to the transparency log but recently turned it down because no one was using it. I'd like to bring it back for stuff like this.

https://github.com/sigstore/gitsign/issues/22