Whats is the certificate that verify the local git users on bitbucket?

crynof

Hi!, i have a question about bitbucket permissions.

I have an account "A" with a mail "a@mail.com" thats is a owner of one repository.
Then i invite an other person named "B" with mail "b@mail.com" and i set at developer.

If i am A, and clone on my PC this repository and set my name and mail with git -config, can i make commits and push.

If i change the git config with B name and mail and i try to commit and push, i can and this is showed in commit line on repository.

If i change again to new C user and mail and try to commit and push, i can also still withous has been seted on Bitbucket like developer.

How can i to restrict commit and push pemision on bitbucket?

Whats is the certificate that verify if the local user preconfigured on git  belong to git repository access permision on bitbucket?

Thanks!

 

Daniil Penkin

Hello @crynof,

Bitbucket Cloud indeed doesn't verify committers, repository permissions are applied to the pusher. And yes, at the moment you can kind of trick anyone browsing your repo by changing you local git configuration. There's a related setting to map unresolved git users to Bitbucket users, see this page.

Unfortunately, Bitbucket Cloud doesn't yet support committer verification nor signed commits.

Let me know if you have any questions.

Cheers,
Daniil