Re:Signing Git commits with your SSH key (2021)
by wongarsu on Wednesday September 14, 2022 @05:29AM
(#32834919)
Commit signing with S/MIME also works great. The downside is that you have to buy an "email" S/MIME cert from one of the usual cert gatekeepers for a couple dollars, but in return anyone can verify the signatures without exchanging public keys with me (or building a web of trust), and expiration and revocation are solved problems (including verifying signatures made with keys that are now expired, which seems not really supported with SSH keys)
[ Parent
| on HN ]
Re:Signing Git commits with your SSH key (2021)
by wlynch on Wednesday September 14, 2022 @05:41AM
(#32834991)
You may want to check out https://github.com/sigstore/gitsign! You can generate ephemeral x509 code signing certs for free using Sigstore.
(disclosure: I'm a maintainer for gitsign)
Re:Signing Git commits with your SSH key (2021)
by politician on Wednesday September 14, 2022 @11:12AM
(#32838376)
Wow! This looks like an incredible ecosystem for managing signatures and for verifying the software artifact supply chain.
Re:Signing Git commits with your SSH key (2021)
by account42 on Wednesday September 14, 2022 @08:05AM
(#32835999)
How is expiration a solved problem? You won't be able to verify commits after the cert expired without additional information because you don't know that the commit timestamp is valid. For code signing you there are timestamping services to solve this but this means that you are now dependent on a central authority which could just host verified hashes without all the crypto mess.