Safe and Signed Git Commits with PGP
Talkat Open Source Summit Europe 2022 · on Thursday, 2022-09-15· at 16:10· Liffey B Part 2 (Level 1), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
Team adopts PGP/GPG to sign Git commits, publishing keys to keyservers and building a web of trust so commits carry verifiable signatures. Git is configured to auto-sign commits per-repo or via -S, and GitHub Enterprise/GitLab can enforce signed commits so unsigned pushes are rejected. Setup requires key distribution, occasional local merges, and key management (master key on paper, subkeys, revocation certs). Outcome: deployed across projects and used successfully with minor workflow overhead.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:08Thomas Qvidahl
- 4:40How encryption and decryption works, the very very short version...
- 5:36Symmetric vs Asymmetric cryptography
- 7:22How Public Key cryptography works, the very very short version...
- 9:41For larger datasets, use symmetric key to encrypt data
- 11:49Hash function
- 14:33My Public Key
- 15:26Pretty Good Privacy
- 16:22Gnu Privacy Guard
- 17:11Installing GPG
- 17:524. Publishing keys and signing other people's keys
- 21:57Signing git commits
- 24:48Enforcing signed git commits
- 28:23Advanced key usage and maintenance
- 31:21Thank you!
related talks
30mPractical (and impractical) git commit signing
49mProtect Your Code with GitHub Security Features
05mIgnite – Konstantin Ryabitsev
38mSecuring Git Repositories with Gittuf
06mKeynote: Signing Git Commits with Gitsign
29mIdentity-based Source Integrity with Gitsign
37mGitsign – Keyless Git Commit Signing
58mProtect your code with GitHub security features