11 ms·

SSH commit verification now supported

227 points by rainworld 4y ago

berryton 4y ago
Nice! It is easier for me to have multiple SSH keys backed by my Yubikey than GPG keys (only 1 GPG key per Yubikey).
- nerdponx 4y ago
  I find it weird that GPG/PGP leans so heavily into "one key per person". Why shouldn't I be encouraged to have 2 or 4 or 10 identities if I want to? If my "web of trust" is diluted as a result, then that's on me (and I don't much care).
  - upofadown 4y ago
    >I find it weird that GPG/PGP leans so heavily into "one key per person". It does? >Why shouldn't I be encouraged to have 2 or 4 or 10 identities if I want to? What is stopping you?
    - lxgr 4y ago
      > It does? At least the OpenPGP smart card specification kind of does, yes. It uses a "single private key stored on the card" (ok, actually three keys) model, whereas FIDO (including SSH‘s security key implementation) uses key handles, which theoretically support an unlimited number of keys per authenticator.
      - aborsy 4y ago
        A key handle seems to be the real private key encrypted with a static key from the hardware key. You can achieve that yourself, for example, using Pass. Encrypt theoretically unlimited number of password and secret keys with the master password in the hardware token.
        lxgr 4y ago
        > A key handle seems to be the real private key encrypted with a static key from the hardware key. It can be, but it‘s essentially just a binary blob. It can also be entropy to deterministically re-derive a private or secret key from an internal root secret, or just a primary key to look up that key or entropy within the token. > You can achieve that yourself, for example, using Pass. How? With a hardware token, you can only do what its protocol allows you to in terms of key derivation. That means that with a standard OpenPGP card, you will not be able to do key handle based key derivation, while with FIDO/CTAP you can. You could obviously develop your own OpenPGP-compatible hardware token standard, but you‘d only be able to use it with a patched version of GPG, GPG agent etc, but a big advantage of OpenPGP smartcards (and even more so FIDO/CTAP tokens) is that they are widely supported without requiring driver installation.
JonathanBeuys 4y ago
If signing commits becomes popular, it would be one of the very first tiny cracks in the stronghold of bigtech over the internet. So far, we trust GitHub that a certain repo is under control of a certain individual or organization. We trust Twitter that a tweet was done by Elon Musk and not by Joe Doe. We trust Instagram, that Sue really got a like from that famous influencer and did not fake it. We trust HN, that I wrote this comment. But if signing these things would become the norm, commits, tweets, likes and posts would become eternal. Independent of any central authorities. Unfortunately, it will probably not become popular. As there is nothing to gain for the author of a commit by signing it.
- wyldfire 4y ago
  > As there is nothing to gain for the author of a commit by signing it. All of the recent focus on supply chain security could result in signed commits becoming more routine.
  - echohack5 4y ago
    Do auditors care? All the ones I've dealt with just want you to log everything and rake your face over the hot pavement for their stamp of approval, actual security be damned. I'm surprised they even require 2FA at all.
    - fmajid 4y ago
      Useless security theater at best. They treat all 2FA as the same, including phishable TOTP or RSA SecurID, and (shudder) SMS.
      - staticassertion 4y ago
        Our auditors were perfectly willing to treat FIDO2 2FA as a specific mitigation against phishable credentials and whatnot. Really depends on your auditor/ the case you make.
        4y ago
LelouBil 4y ago
I'm still a student, but I enabled commit signing for all of my friends after showing them the Linus Torvalds fake commits.
smileybarry 4y ago
Great! So now you can sign commits on Windows (on GH repos) without installing GPG4Win (or having to use a WSL GPG)
- lostmsu 4y ago
  Or not: https://github.com/git-for-windows/git/issues/3883 https://github.com/git-for-windows/git/issues/3883
  - smileybarry 4y ago
    Looks like you can side-step this entire issue by using Windows' own OpenSSH port: https://superuser.com/questions/1695601/use-ssh-key-signing-with-git-and-ssh-agent-under-windows https://superuser.com/questions/1695601/use-ssh-key-signing-...
    - lostmsu 4y ago
      Fixed it locally by installing updated SSH client and forcing git to use it: git config --global "gpg.ssh.program" "C:/Program Files/OpenSSH/ssh-keygen.exe"
dlor 4y ago
Shameless plug for the gitsign project in sigstore: https://github.com/sigstore/gitsign https://github.com/sigstore/gitsign This isn't supported by GitHub yet but we're hopefully working towards that too.
- fariszr 4y ago
  Is there any other Git host/platform that supports it? Gitea/GitLab?
  - sytse 4y ago
    It seems on GitLab this is being working on in https://gitlab.com/gitlab-org/gitlab/-/issues/343879 https://gitlab.com/gitlab-org/gitlab/-/issues/343879 with part of the work already merged in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87962 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87962 and https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88693 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88693
    - fariszr 4y ago
      What about Sigstore, is there any plan on supporting it?
      - wlynch 4y ago
        You can find the feature request for supporting keyless sigstore/gitsign at https://gitlab.com/gitlab-org/gitlab/-/issues/364428 https://gitlab.com/gitlab-org/gitlab/-/issues/364428
      - sytse 4y ago
        Sorry, I missed the context your original question was about Sigstore. Someone answered in https://news.ycombinator.com/item?id=32569872 https://news.ycombinator.com/item?id=32569872
  - wlynch 4y ago
    Worth calling out that gitsign works with any Git host for the commit signatures / verification! The main piece that's platform specific is the Verified badges that you see in the UI + any CI checks.
perlgeek 4y ago
Neat, I didn't even know you can sign git commits with SSH! Seems to be a pretty new feature too; [1] claims it's from November 2021. [1] https://calebhearth.com/sign-git-with-ssh https://calebhearth.com/sign-git-with-ssh
renewiltord 4y ago
Need git > 2.34 to make this work. Mac OS git is 2.32 which doesn't work. Had to homebrew install. EDIT: Interestingly, updating gave me a neat suggestion to use: git config --global --add --bool push.autoSetupRemote true So it's a win in another sense for me too.
- MatthiasPortzel 4y ago
  Homebrew-installing newer versions than the macOS provided ones is a must in my opinion. I also recommend upgraded the Apple-provided versions of other utilities you use (e.g. less, Ruby, vim, etc.) I had upgraded git to get `git switch`
  - cestith 4y ago
    If you're used to GNU find and grep, and maybe tar, then getting those from homebrew or macports is a major improvement too.
hn_user145 4y ago
Is this backward compatible with clients that do not support SSH signing yet or older versions of git? i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?
- Beltalowda 4y ago
  It's just ignored. The signing data is added in the same way as a GPG key, just in a different format. Git commands don't look at signatures by default, and if they do, they will just say "invalid signing format" or some such. It's always possible some program handles this badly, but I've been signing with ssh pretty much since the day it was added to git (before it was in a release) and never experienced any problems or complaints.
therealmarv 4y ago
Beware: Signing commits with SSH or GPG keys removes the "plausible deniability" [1][2]. Of course certain projects (especially if very critical or secure systems) definitely benefit from that but imagine you put your handwritten signature on every single step of your work (hint: you don't do that in the real World). You would never do so for normal internet activity like Google searches, Twitter or Facebook yet you want to sign your git commits with a signature undeniable connected to yourself, probably also connected to your real name. If you just think that signing is just a "cool feature to have" then you should really educate yourself about implications of having a connected (real name?) identity on the internet. [1] https://en.wikipedia.org/wiki/Plausible_deniability https://en.wikipedia.org/wiki/Plausible_deniability [2] https://legaldictionary.net/plausible-deniability/ https://legaldictionary.net/plausible-deniability/ P.S.: I just wanted to make people think before activating this feature. Most GitHub code and repositories worked perfectly without it. Do you really need it? When yes, why?
- ehutch79 4y ago
  Why wouldn't you want this? Committing code is not like browsing facebook, or searching on google. Even then, your name is on any posts you're making on twitter or facebook, and i'm sure google knows what you're searching. As a maintainer, why would you want people to be able to deny making a given commit? or have them come in completely anonymously?
  - sodality2 4y ago
    Say you’re writing some code that may be illegal (piracy stream, rips off another API with licensed content, etc). I would want to deny that it was me (but then, i wouldn’t connect it to my real-life identity at all).
    - ducktective 4y ago
      It's that serious? Wouldn't the offended party just ask for the content/service/repo be removed?
giomasce 4y ago
What are the advantages of signing with SSH rather than GPG?
- Shank 4y ago
  For starters, you don't have to manage two keys at minimum. That's already a plus. For another reason, I wasted a lot of time diagnosing problems with gpg not working correctly, from the daemon crashing and needing to be killed periodically to random lockups or failed signatures due to keys not being unlocked. All of that is alleviated with ssh. Edit: Turns out this still uses gpg? I think?
  - divbzero 4y ago
    My gut feeling is to create a separate key for signing but I’m not sure why. Is there downside to using the same SSH key for both signing and login?
    - cmeacham98 4y ago
      If you wish for a computer to be able to sign commits but not push (or push commits but not sign) that would be impossible. Anytime you use that public key (for example, to SSH into a server) that session is linked to your identity via git commits (this doesn't actually matter for github, as github exposes all your SSH keys via its API anyways).
    - tialaramex 4y ago
      Ordinarily you should not use private keys for more than one purpose because the algorithms may make it possible for bad guys to surprise you with the consequences. e.g. you sign a document vouching for someone to adopt a cat, but it turns out actually when interpreted as a bank sign-in instead of cat adoption document your signature still works. However, the OpenSSH team were very careful to design their signature feature so that what is signed is always different from any possible SSH login. Now, of course if you sign a text document which says "I want Bill to have all my stuff" but you meant, you know, Bill at work, can keep my stapler and that cool glow-in-the-dark mug, because I'm leaving next week and I can't be bothered to box it all up and take it, whereas your 2nd cousin William tries to persuade a judge it's a legal Will, and so your untimely death in a car crash should result in him inheriting everything instead of your bereaved wife and six year old daughter - well, that OpenSSH can't do anything about. But you would be correct to assume it is not safe in general to use keys for unrelated purposes, and only the (documented and justified) choice by OpenSSH reverses that assumption for the SSH tools.
mooreds 4y ago
So I can upload my public key, and GitHub will associated it with my commits. Do I sign it locally with my private key? This below doc indicates "no" but if not then, when? > To set your SSH signing key in Git, paste the text below, substituting the contents of your clipboard [which contains the public key] for the key you'd like to use. Since the key contains spaces, you must wrap it in quotes: https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key https://docs.github.com/en/authentication/managing-commit-si... Or am I missing something?
- akerl_ 4y ago
  You sign with your private key. You’re using the public key as an identifier to tell your git client which key to use, since git can use the public key to confirm it’s using the right private key.
  - mooreds 4y ago
    Ah, thanks!
- mirekrusin 4y ago
  When you push to git via ssh which uses this key?
Sohcahtoa82 4y ago
Is there any reason to use commit signing in a private corporate GH repo? The only thing I could see it really preventing is a malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone else catching it.
- shawabawa3 4y ago
  > malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone else catching it. You are massively overconfident about the protections code review provides. But even if you _are_ confident in code reviews, you can push code to someone else's PR under their name, then approve it yourself and ship it yourself. It also opens up social engineering vectors. Create a PR by CEO/CTO/Senior Security Engineer/whatever, with some critical sounding bug fix impacting $BIG_CLIENT, then you DM someone "hey, $IMPORTANT_PERSON needs this shipped ASAP, can you help us out with a quick +1?"
  - Sohcahtoa82 4y ago
    In both cases, you're leaving a paper trail that you were involved. In the first, you approved bad code. In the second, you asked someone to approve bad code. Of course, who knows how long that bad code could sit in prod before it gets noticed is a toss-up, and preventing it from happening is going to be infinitely better than just logging it. Got any other scenarios that commit signing would solve?
3np 4y ago
Finally. Github does not recognize GPG signatures for commits where the e-mail field does not match an e-mail address verified with GH. So you'd have to make your e-mail public to have your commits show as green. This seems to fill that gap. (Using a burner has the problem that a valid-looking mail might have people legitimately try to reach out, which is not nice)
- deric4 4y ago
  you can use your no-reply email address https://docs.github.com/en/authentication/managing-commit-signature-verification/associating-an-email-with-your-gpg-key https://docs.github.com/en/authentication/managing-commit-si... `ID+username@users.noreply.github.com`
  - NetOpWibby 4y ago
    Wow, had no idea this was possible.
  - 3np 4y ago
    Oh, I think that's relatively new? Tried to do exactly that a year or two back but wasn't recognized then.
- computerfriend 4y ago
  You can add and verify an email address without making it public in GitHub. But, the PGP signature is public and contains the email address associated with the signing key, so if you use PGP signatures at all, your email address is public anyway, regardless of the "verified commit" badge.
  - 3np 4y ago
    Well yes but `username-noreply@example.com` should make it immediately clear that no one will be reading e-mail sent there. As noted in a sibling, GH now recognizes using the github noreply addresses since some time a well.
grncdr 4y ago
Does anybody know if this only verifies _new_ commits? I've been signing my commits with my SSH key for a while, but older commits still show as unverified in the web UI. They show the hash of the public key the commit was signed with, which matches a public key associated with my account in the account settings, but the commit still says "Unverified". Example: https://github.com/grncdr/dev-mode/commit/06376070aff042e9d5b9114994335e5205f0a0f6 https://github.com/grncdr/dev-mode/commit/06376070aff042e9d5...
- tylerhou 4y ago
  My guess is that they may have forgotten to backfill old data (because probably whether a commit is verified is not computed on the fly), but I don't see why it can't apply retroactively. Maybe try removing and adding the public key from your account? That might trigger the system to scan all your commits and re-verify.
- arccy 4y ago
  All my old commits show as verified now
- Reitet00 4y ago
  You need to re-add your SSH key and there's a new key type select box that has "signing" option. The old keys are only good for auth.
  - grncdr 4y ago
    This was it, thanks for the pointer!
- caleb_thompson 4y ago
  You'll need to re-upload your public SSH key as a signing key for the signatures to be shown as verified. https://calebhearth.com/sign-git-with-ssh#github https://calebhearth.com/sign-git-with-ssh#github
  - grncdr 4y ago
divbzero 4y ago
What is the benefit of signing a commit with a SSH key vs. a GPG key? Is it simply being able to use ssh-keygen instead of gpg?
hk1337 4y ago
In most cases I presume this isn't a big deal but is it wise for your auth key and signing key to be the same key pair?
- lxgr 4y ago
  Generally, no; in this particular case (SSH authentication and generic signatures), it seems to be ok: https://www.agwa.name/blog/post/ssh_signatures https://www.agwa.name/blog/post/ssh_signatures
lostmsu 4y ago
Signing using SSH keys does not work reliably on Windows: https://github.com/git-for-windows/git/issues/3883 https://github.com/git-for-windows/git/issues/3883
- lostmsu 4y ago
  Fixed it locally by installing updated SSH client and forcing git to use it: git config --global "gpg.ssh.program" "C:/Program Files/OpenSSH/ssh-keygen.exe"
rubyist5eva 4y ago
Finally! only reason I've been keeping gpg around has been to sign git commits, so now I can just sign with my ssh key. Wonderful
stavros 4y ago
Finally, one step closer to the dream of having a dirt-cheap, unphishable, unstealable FIDO2 key for all my security needs. Now all we need is for WebAuthn to catch on.
- kylehotchkiss 4y ago
  How do you implement this as unstealable?
  - lelandfe 4y ago
    As always https://xkcd.com/538/ https://xkcd.com/538/
  - stavros 4y ago
    You need the physical key plus a password/PIN that deletes the data after N wrong tries.

227 points by rainworld 4y ago

berryton 4y ago

Nice! It is easier for me to have multiple SSH keys backed by my Yubikey than GPG keys (only 1 GPG key per Yubikey).

nerdponx 4y ago
I find it weird that GPG/PGP leans so heavily into "one key per person". Why shouldn't I be encouraged to have 2 or 4 or 10 identities if I want to? If my "web of trust" is diluted as a result, then that's on me (and I don't much care).
- upofadown 4y ago
  >I find it weird that GPG/PGP leans so heavily into "one key per person". It does? >Why shouldn't I be encouraged to have 2 or 4 or 10 identities if I want to? What is stopping you?
  - lxgr 4y ago
    > It does? At least the OpenPGP smart card specification kind of does, yes. It uses a "single private key stored on the card" (ok, actually three keys) model, whereas FIDO (including SSH‘s security key implementation) uses key handles, which theoretically support an unlimited number of keys per authenticator.
    - aborsy 4y ago
      A key handle seems to be the real private key encrypted with a static key from the hardware key. You can achieve that yourself, for example, using Pass. Encrypt theoretically unlimited number of password and secret keys with the master password in the hardware token.
      - lxgr 4y ago
        > A key handle seems to be the real private key encrypted with a static key from the hardware key. It can be, but it‘s essentially just a binary blob. It can also be entropy to deterministically re-derive a private or secret key from an internal root secret, or just a primary key to look up that key or entropy within the token. > You can achieve that yourself, for example, using Pass. How? With a hardware token, you can only do what its protocol allows you to in terms of key derivation. That means that with a standard OpenPGP card, you will not be able to do key handle based key derivation, while with FIDO/CTAP you can. You could obviously develop your own OpenPGP-compatible hardware token standard, but you‘d only be able to use it with a patched version of GPG, GPG agent etc, but a big advantage of OpenPGP smartcards (and even more so FIDO/CTAP tokens) is that they are widely supported without requiring driver installation.

JonathanBeuys 4y ago

If signing commits becomes popular, it would be one of the very first tiny cracks in the stronghold of bigtech over the internet. So far, we trust GitHub that a certain repo is under control of a certain individual or organization. We trust Twitter that a tweet was done by Elon Musk and not by Joe Doe. We trust Instagram, that Sue really got a like from that famous influencer and did not fake it. We trust HN, that I wrote this comment. But if signing these things would become the norm, commits, tweets, likes and posts would become eternal. Independent of any central authorities. Unfortunately, it will probably not become popular. As there is nothing to gain for the author of a commit by signing it.

wyldfire 4y ago
> As there is nothing to gain for the author of a commit by signing it. All of the recent focus on supply chain security could result in signed commits becoming more routine.
- echohack5 4y ago
  Do auditors care? All the ones I've dealt with just want you to log everything and rake your face over the hot pavement for their stamp of approval, actual security be damned. I'm surprised they even require 2FA at all.
  - fmajid 4y ago
    Useless security theater at best. They treat all 2FA as the same, including phishable TOTP or RSA SecurID, and (shudder) SMS.
    - staticassertion 4y ago
      Our auditors were perfectly willing to treat FIDO2 2FA as a specific mitigation against phishable credentials and whatnot. Really depends on your auditor/ the case you make.
      - 4y ago

LelouBil 4y ago

I'm still a student, but I enabled commit signing for all of my friends after showing them the Linus Torvalds fake commits.

smileybarry 4y ago

Great! So now you can sign commits on Windows (on GH repos) without installing GPG4Win (or having to use a WSL GPG)

lostmsu 4y ago
Or not: https://github.com/git-for-windows/git/issues/3883 https://github.com/git-for-windows/git/issues/3883
- smileybarry 4y ago
  Looks like you can side-step this entire issue by using Windows' own OpenSSH port: https://superuser.com/questions/1695601/use-ssh-key-signing-with-git-and-ssh-agent-under-windows https://superuser.com/questions/1695601/use-ssh-key-signing-...
  - lostmsu 4y ago
    Fixed it locally by installing updated SSH client and forcing git to use it: git config --global "gpg.ssh.program" "C:/Program Files/OpenSSH/ssh-keygen.exe"

dlor 4y ago

Shameless plug for the gitsign project in sigstore: https://github.com/sigstore/gitsign https://github.com/sigstore/gitsign This isn't supported by GitHub yet but we're hopefully working towards that too.

fariszr 4y ago
Is there any other Git host/platform that supports it? Gitea/GitLab?
- sytse 4y ago
  It seems on GitLab this is being working on in https://gitlab.com/gitlab-org/gitlab/-/issues/343879 https://gitlab.com/gitlab-org/gitlab/-/issues/343879 with part of the work already merged in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87962 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/87962 and https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88693 https://gitlab.com/gitlab-org/gitlab/-/merge_requests/88693
  - fariszr 4y ago
    What about Sigstore, is there any plan on supporting it?
    - wlynch 4y ago
      You can find the feature request for supporting keyless sigstore/gitsign at https://gitlab.com/gitlab-org/gitlab/-/issues/364428 https://gitlab.com/gitlab-org/gitlab/-/issues/364428
    - sytse 4y ago
      Sorry, I missed the context your original question was about Sigstore. Someone answered in https://news.ycombinator.com/item?id=32569872 https://news.ycombinator.com/item?id=32569872
- wlynch 4y ago
  Worth calling out that gitsign works with any Git host for the commit signatures / verification! The main piece that's platform specific is the Verified badges that you see in the UI + any CI checks.

perlgeek 4y ago

Neat, I didn't even know you can sign git commits with SSH! Seems to be a pretty new feature too; [1] claims it's from November 2021. [1] https://calebhearth.com/sign-git-with-ssh https://calebhearth.com/sign-git-with-ssh

renewiltord 4y ago

Need git > 2.34 to make this work. Mac OS git is 2.32 which doesn't work. Had to homebrew install. EDIT: Interestingly, updating gave me a neat suggestion to use: git config --global --add --bool push.autoSetupRemote true So it's a win in another sense for me too.

MatthiasPortzel 4y ago
Homebrew-installing newer versions than the macOS provided ones is a must in my opinion. I also recommend upgraded the Apple-provided versions of other utilities you use (e.g. less, Ruby, vim, etc.) I had upgraded git to get `git switch`
- cestith 4y ago
  If you're used to GNU find and grep, and maybe tar, then getting those from homebrew or macports is a major improvement too.

hn_user145 4y ago

Is this backward compatible with clients that do not support SSH signing yet or older versions of git? i.e What happens if I push a SSH signed commit to a Gitlab or Bitbucket remote or mirror the repository? How do the commits appear to a client that does not understand SSH signatures?

Beltalowda 4y ago
It's just ignored. The signing data is added in the same way as a GPG key, just in a different format. Git commands don't look at signatures by default, and if they do, they will just say "invalid signing format" or some such. It's always possible some program handles this badly, but I've been signing with ssh pretty much since the day it was added to git (before it was in a release) and never experienced any problems or complaints.

therealmarv 4y ago

Beware: Signing commits with SSH or GPG keys removes the "plausible deniability" [1][2]. Of course certain projects (especially if very critical or secure systems) definitely benefit from that but imagine you put your handwritten signature on every single step of your work (hint: you don't do that in the real World). You would never do so for normal internet activity like Google searches, Twitter or Facebook yet you want to sign your git commits with a signature undeniable connected to yourself, probably also connected to your real name. If you just think that signing is just a "cool feature to have" then you should really educate yourself about implications of having a connected (real name?) identity on the internet. [1] https://en.wikipedia.org/wiki/Plausible_deniability https://en.wikipedia.org/wiki/Plausible_deniability [2] https://legaldictionary.net/plausible-deniability/ https://legaldictionary.net/plausible-deniability/ P.S.: I just wanted to make people think before activating this feature. Most GitHub code and repositories worked perfectly without it. Do you really need it? When yes, why?

ehutch79 4y ago
Why wouldn't you want this? Committing code is not like browsing facebook, or searching on google. Even then, your name is on any posts you're making on twitter or facebook, and i'm sure google knows what you're searching. As a maintainer, why would you want people to be able to deny making a given commit? or have them come in completely anonymously?
- sodality2 4y ago
  Say you’re writing some code that may be illegal (piracy stream, rips off another API with licensed content, etc). I would want to deny that it was me (but then, i wouldn’t connect it to my real-life identity at all).
  - ducktective 4y ago
    It's that serious? Wouldn't the offended party just ask for the content/service/repo be removed?

giomasce 4y ago

What are the advantages of signing with SSH rather than GPG?

Shank 4y ago
For starters, you don't have to manage two keys at minimum. That's already a plus. For another reason, I wasted a lot of time diagnosing problems with gpg not working correctly, from the daemon crashing and needing to be killed periodically to random lockups or failed signatures due to keys not being unlocked. All of that is alleviated with ssh. Edit: Turns out this still uses gpg? I think?
- divbzero 4y ago
  My gut feeling is to create a separate key for signing but I’m not sure why. Is there downside to using the same SSH key for both signing and login?
  - cmeacham98 4y ago
    If you wish for a computer to be able to sign commits but not push (or push commits but not sign) that would be impossible. Anytime you use that public key (for example, to SSH into a server) that session is linked to your identity via git commits (this doesn't actually matter for github, as github exposes all your SSH keys via its API anyways).
  - tialaramex 4y ago
    Ordinarily you should not use private keys for more than one purpose because the algorithms may make it possible for bad guys to surprise you with the consequences. e.g. you sign a document vouching for someone to adopt a cat, but it turns out actually when interpreted as a bank sign-in instead of cat adoption document your signature still works. However, the OpenSSH team were very careful to design their signature feature so that what is signed is always different from any possible SSH login. Now, of course if you sign a text document which says "I want Bill to have all my stuff" but you meant, you know, Bill at work, can keep my stapler and that cool glow-in-the-dark mug, because I'm leaving next week and I can't be bothered to box it all up and take it, whereas your 2nd cousin William tries to persuade a judge it's a legal Will, and so your untimely death in a car crash should result in him inheriting everything instead of your bereaved wife and six year old daughter - well, that OpenSSH can't do anything about. But you would be correct to assume it is not safe in general to use keys for unrelated purposes, and only the (documented and justified) choice by OpenSSH reverses that assumption for the SSH tools.

mooreds 4y ago

So I can upload my public key, and GitHub will associated it with my commits. Do I sign it locally with my private key? This below doc indicates "no" but if not then, when? > To set your SSH signing key in Git, paste the text below, substituting the contents of your clipboard [which contains the public key] for the key you'd like to use. Since the key contains spaces, you must wrap it in quotes: https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-ssh-key https://docs.github.com/en/authentication/managing-commit-si... Or am I missing something?

akerl_ 4y ago
You sign with your private key. You’re using the public key as an identifier to tell your git client which key to use, since git can use the public key to confirm it’s using the right private key.
- mooreds 4y ago
  Ah, thanks!
mirekrusin 4y ago
When you push to git via ssh which uses this key?

Sohcahtoa82 4y ago

Is there any reason to use commit signing in a private corporate GH repo? The only thing I could see it really preventing is a malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone else catching it.

shawabawa3 4y ago
> malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone else catching it. You are massively overconfident about the protections code review provides. But even if you _are_ confident in code reviews, you can push code to someone else's PR under their name, then approve it yourself and ship it yourself. It also opens up social engineering vectors. Create a PR by CEO/CTO/Senior Security Engineer/whatever, with some critical sounding bug fix impacting $BIG_CLIENT, then you DM someone "hey, $IMPORTANT_PERSON needs this shipped ASAP, can you help us out with a quick +1?"
- Sohcahtoa82 4y ago
  In both cases, you're leaving a paper trail that you were involved. In the first, you approved bad code. In the second, you asked someone to approve bad code. Of course, who knows how long that bad code could sit in prod before it gets noticed is a toss-up, and preventing it from happening is going to be infinitely better than just logging it. Got any other scenarios that commit signing would solve?

3np 4y ago

Finally. Github does not recognize GPG signatures for commits where the e-mail field does not match an e-mail address verified with GH. So you'd have to make your e-mail public to have your commits show as green. This seems to fill that gap. (Using a burner has the problem that a valid-looking mail might have people legitimately try to reach out, which is not nice)

deric4 4y ago
you can use your no-reply email address https://docs.github.com/en/authentication/managing-commit-signature-verification/associating-an-email-with-your-gpg-key https://docs.github.com/en/authentication/managing-commit-si... `ID+username@users.noreply.github.com`
- NetOpWibby 4y ago
  Wow, had no idea this was possible.
- 3np 4y ago
  Oh, I think that's relatively new? Tried to do exactly that a year or two back but wasn't recognized then.
computerfriend 4y ago
You can add and verify an email address without making it public in GitHub. But, the PGP signature is public and contains the email address associated with the signing key, so if you use PGP signatures at all, your email address is public anyway, regardless of the "verified commit" badge.
- 3np 4y ago
  Well yes but `username-noreply@example.com` should make it immediately clear that no one will be reading e-mail sent there. As noted in a sibling, GH now recognizes using the github noreply addresses since some time a well.

grncdr 4y ago

Does anybody know if this only verifies _new_ commits? I've been signing my commits with my SSH key for a while, but older commits still show as unverified in the web UI. They show the hash of the public key the commit was signed with, which matches a public key associated with my account in the account settings, but the commit still says "Unverified". Example: https://github.com/grncdr/dev-mode/commit/06376070aff042e9d5b9114994335e5205f0a0f6 https://github.com/grncdr/dev-mode/commit/06376070aff042e9d5...

tylerhou 4y ago
My guess is that they may have forgotten to backfill old data (because probably whether a commit is verified is not computed on the fly), but I don't see why it can't apply retroactively. Maybe try removing and adding the public key from your account? That might trigger the system to scan all your commits and re-verify.
arccy 4y ago
All my old commits show as verified now
Reitet00 4y ago
You need to re-add your SSH key and there's a new key type select box that has "signing" option. The old keys are only good for auth.
- grncdr 4y ago
  This was it, thanks for the pointer!
caleb_thompson 4y ago
You'll need to re-upload your public SSH key as a signing key for the signatures to be shown as verified. https://calebhearth.com/sign-git-with-ssh#github https://calebhearth.com/sign-git-with-ssh#github
- grncdr 4y ago

divbzero 4y ago

What is the benefit of signing a commit with a SSH key vs. a GPG key? Is it simply being able to use ssh-keygen instead of gpg?

hk1337 4y ago

In most cases I presume this isn't a big deal but is it wise for your auth key and signing key to be the same key pair?

lxgr 4y ago
Generally, no; in this particular case (SSH authentication and generic signatures), it seems to be ok: https://www.agwa.name/blog/post/ssh_signatures https://www.agwa.name/blog/post/ssh_signatures

lostmsu 4y ago

Signing using SSH keys does not work reliably on Windows: https://github.com/git-for-windows/git/issues/3883 https://github.com/git-for-windows/git/issues/3883

lostmsu 4y ago
Fixed it locally by installing updated SSH client and forcing git to use it: git config --global "gpg.ssh.program" "C:/Program Files/OpenSSH/ssh-keygen.exe"

rubyist5eva 4y ago

Finally! only reason I've been keeping gpg around has been to sign git commits, so now I can just sign with my ssh key. Wonderful

stavros 4y ago

Finally, one step closer to the dream of having a dirt-cheap, unphishable, unstealable FIDO2 key for all my security needs. Now all we need is for WebAuthn to catch on.

kylehotchkiss 4y ago
How do you implement this as unstealable?
- lelandfe 4y ago
  As always https://xkcd.com/538/ https://xkcd.com/538/
- stavros 4y ago
  You need the physical key plus a password/PIN that deletes the data after N wrong tries.