Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

Also note that until you can individually get the good actors' public key you can't verify their commits. So it's not enough to distribute the instructions in this webpage, you also have to have a trusted key exchange. Everyone who wants to verify commits will need a copy of everyone who might sign commits' public keys.

If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.



> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities.

This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rule...

And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there.

Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/polic...

An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-r...


> If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.

Additionally you can enable "Vigilant Mode" to make it obvious when commits are untrusted.

https://github.blog/changelog/2021-04-28-flag-unsigned-commi...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: