Gitsign – Keyless Git Commit Signing
summary
Gitsign brings keyless signing to Git by generating ephemeral key pairs, exchanging an OIDC token with Fulcio to obtain short-lived certs (10 minute lifetime), and publishing signatures and certs to the Rekor transparency log so commits remain verifiable long after the cert expires. It signs commit objects (precomputing the commit SHA), integrates with the Git CLI and GitHub Actions, and demonstrated a working flow with no long‑lived key on disk. Tradeoffs include requiring online OIDC/Rekor access which breaks fully offline Git usage.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:11Attacks in the wild
- 5:09What's in a commit
- 6:58What's in a signed commit
- 7:39How Signing Works
- 8:33How Verification Works
- 9:08Challenges with traditional signing
- 13:54Sigstore Adoption
- 24:01How Keyless Signing Works
- 28:26What's next
related talks
06mKeynote: Signing Git Commits with Gitsign
29mIdentity-based Source Integrity with Gitsign
10mSource Attestations with Gitsign
30mPractical (and impractical) git commit signing
15mDemystifying Digital Signatures
38mSecuring Git Repositories with Gittuf
40mSigstore: How We Started, Where We Are, Where We are Headed
34mSafe and Signed Git Commits with PGP