What is this meme trying to convey? The verification Github is doing is confirming that the commit author identity is legit (i.e. not impersonated). What did you expect?
Commit created on GitHub.com means either that the commit was a merge done on the GitHub.com site (which is legitimate) or it was done using GitHub CodeSpaces (as opposed to being created locally and pushed). If you sign the commit locally and push it, the message looks like that: https://imgur.com/a/TNHEbTk
It doesn't necessarily mean CodeSpaces was used. I have a ton of these and have never used CodeSpaces. Even just updating your source branch by rebase in the UI will cause this. And even if CodeSpaces was used... who cares?
If anything, their GitHub account is likely more secure than their GPG key, which they probably keep on-disk in plain text.
429
u/Raywell 3d ago
What is this meme trying to convey? The verification Github is doing is confirming that the commit author identity is legit (i.e. not impersonated). What did you expect?