News for hackers. Stuff that matters.

A comment on Obtain a GitHub user's public keys. Parent comment

Re:Obtain a GitHub user's public keys by mitchty on Monday June 16, 2014 @10:50AM (#7899344)
It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions.

Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.

[ Parent | on HN ]
Re:Obtain a GitHub user's public keys by robryk on Monday June 16, 2014 @11:49AM (#7899662)
Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
[ Parent | on HN ]
Re:Obtain a GitHub user's public keys by TheLoneWolfling on Monday June 16, 2014 @12:58PM (#7900059)
Not necessarily. It could do key pinning for example, which at least protects already-established users.
[ Parent | on HN ]
Re:Obtain a GitHub user's public keys by mitchty on Wednesday June 18, 2014 @06:47PM (#7913396)
Additionally, if you use gpg to build your ssh keys and have a trust/sign chain you could then pull this stuff with impunity as long as you keep the trust chain issues sorted.
[ Parent | on HN ]