Menu
I'd like to build a trusted path for software development. This means that every change in to code must be signed by the author and one reviewer, before being accepted. These signatures for the changes must be verifiable at release time, or there must be some other means of making sure the repository can not have been tampered, or additional changes added.
The version control system that I am expecting to use for this is git, but other options are also accepted. Signing can be via GnuPG or SSL certificates.
The workflow I am thinking would be roughly:
Merging does not have to be foolproof such as that unreviewed changes would need to be unmergeable to trunk - just that before a release, there needs to be a way to check if there are any unreviewed (unsigned) changes in trunk. And in general, tampering need not be prevented, only detected.
I'd like a short guide on how to set this up and how each operation is done. Once I get some pointers, I can figure out the specifics myself.
Also, I already know about 'git tag -s' technically, but I am unsure how to apply it to this particular problem.
250
If you're interested in signing commits directly instead of just the tags, all you need to do is add a -S to your git commit command. To see and verify these signatures, there is also a --show-signature option to git log .
Using GPG, SSH, or S/MIME, you can sign tags and commits locally. These tags or commits are marked as verified on GitHub so other people can be confident that the changes come from a trusted source.
By signing your commits you can prove that you are the author. You can be sure the code has not been tampered with. And signed commits could act as a reliable source for an audit trail.
There are three commands with similar names: git reset , git restore and git revert .
The changes will not be signed until you tag. Anything before that point can be verified by the author or by another out-of-band mechanism, but not from within git.
git can verify that a change's heritage is correct, but only the signed tag can verify the change itself is correct.
For your workflow, you may just find yourself tagging a lot.
187
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
