Use KeePassXC to sign your Git commits
code.mendhak.com
Use KeePassXC to sign your Git commits
1–10 of 29 posts
Re: Use KeePassXC to sign your Git commits
#2What’s the reason I would want to do this? Is there a specific threat I need to be aware of with regard to threat vector on git commits?
Re: Use KeePassXC to sign your Git commits
#3What’s the reason I would want to do this? Is there a specific threat I need to be aware of with regard to threat vector on git commits?
SBOM/chain of custody all the way back to an individual doing a commit.
Re: Use KeePassXC to sign your Git commits
#4I am a little confused. Some time back, I added my github ssh key to KeePassXC, and checked the option to Add key to the ssh agent when I unlock my database.
I can then just sign my commits. I don't recall doing any of these settings at all.
Re: Use KeePassXC to sign your Git commits
#5What’s the reason I would want to do this? Is there a specific threat I need to be aware of with regard to threat vector on git commits?
We are on computers, so everything can be changed all the time. E.g. there could be malware that changes a cloned git repos commits before you compile the software.
If the commits are signed that malware would have to know the private key of that dev to do that, which is one additional hurdle that makes this kind of attack way harder to pull off.
Re: Use KeePassXC to sign your Git commits
#6Re: Use KeePassXC to sign your Git commits
#7I am a little confused. Some time back, I added my github ssh key to KeePassXC, and checked the option to Add key to the ssh agent when I unlock my database. I can then just sign my commits. I don't recall doing any of these settings at all.
signed with ssh key instead
Re: Use KeePassXC to sign your Git commits
#8What’s the reason I would want to do this? Is there a specific threat I need to be aware of with regard to threat vector on git commits?
Ideally your CD system would refuse to deploy commits signed with keys it doesn't recognise, but I've never seen that implemented.
Re: Use KeePassXC to sign your Git commits
#9Re: Use KeePassXC to sign your Git commits
#10What’s the reason I would want to do this? Is there a specific threat I need to be aware of with regard to threat vector on git commits?
Ideally your CD system would refuse to deploy commits signed with keys it doesn't recognise, but I've never seen that implemented.
In Gentoo, I believe we already reject pushing unsigned commits.