I've been playing about with the command line pushing commits into a repo. The repo is private and therefore I need to authenticate with either HTTPS or SSH - I get the same following behavior either way.
It appears, despite authenticating, that I can chose to commit using any identity I want simply by changing the user.email config setting. If I change it to a colleagues email address the commit appears to have been made by him.
Am I missing a repo setting that forces the commit to be under the authenticated user's identity? As it stands things appear to be pretty broken from an audit point of view.
