GitHub is adding verified push records. What evidence do you keep for your code?

On October 12, GitHub announced a limited public preview for Enterprise customers that records the authenticated account that pushed a commit, alongside its author and committer details.

GitHub explains why this matters: the usual author name and email are supplied by the client and can be set to someone else’s details.

For me, this is a reason to keep several kinds of records when documenting your work.

I handle marketing for Ecode. Our service lets you register a file’s SHA-256 fingerprint and receive a certificate with a trusted RFC 3161 timestamp. Registration is free, and your source code stays on your device.

The certificate records the file’s fingerprint and registration details. Keep it with the original file, development history and relevant correspondence to support your authorship evidence.

A record of who uploaded code and a record of when a file existed answer different questions. Both can be useful when reconstructing a project’s history.

What evidence would you want to have available if someone challenged your contribution to a project?

"GitHub announcement" (https://github.blog/changelog/20...)

Try Ecode for free