wlynch
Re:Signing Git commits with your SSH key (2021)
on Wednesday September 14, 2022 @05:41AM (#32834991)
You may want to check out https://github.com/sigstore/gitsign! You can generate ephemeral x509 code signing certs for free using Sigstore.
(disclosure: I'm a maintainer for gitsign)
Re:SSH commit verification now supported
on Tuesday August 23, 2022 @03:51PM (#32570508)
+1 to this!
https://docs.sigstore.dev/fulcio/certificate-issuing-overvie... has a good overview of how the certificate issuing works.
With Gitsign, by default a new keypair is generated per signing event (i.e. per commit) and never hits disk. The cert in the commit signature holds the public key, which we can check against Rekor (https://docs.sigstore.dev/rekor/overview) to verify it was valid at the time of signing.
If you have the time, https://www.youtube.com/watch?v=PVhRQFS9Njg is a great deep dive into how Sigstore works in general!
Re:SSH commit verification now supported
on Tuesday August 23, 2022 @03:21PM (#32569995)
Worth calling out that gitsign works with any Git host for the commit signatures / verification!
The main piece that's platform specific is the Verified badges that you see in the UI + any CI checks.
Re:SSH commit verification now supported
on Tuesday August 23, 2022 @03:15PM (#32569872)
You can find the feature request for supporting keyless sigstore/gitsign at https://gitlab.com/gitlab-org/gitlab/-/issues/364428
Balancing privacy vs transparency is definitely something that's tricky! You may be interested in https://blog.sigstore.dev/privacy-in-sigstore-57cac15af0d0 which goes into some of the background of why email addresses are used and some of the things we're thinking about in this area for Sigstore.
Disclosure: I'm the creator of gitsign and wrote this blog post.
Introducing Gitsign – Keyless Git commit signing with Sigstore
Re: Google announces Cloud Build, its new continuous integration platform
on Wednesday July 25, 2018 @09:15AM (#17608978)