Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setup Keybase.io, GPG and Git to sign commits on GitHub

github.com

Post reply on HN
Print view View original

51–60 of 121 posts

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#51

Post by StavrosK »

akerro wrote: post #43
StavrosK wrote: post #40

Earlier quoted context omitted.

How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros

OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.

> Where is your email address? Was that stawros or stavros?

It's right in the key!

> Do I really need to copy the key or .asc address, wget it and import?

Is this a failure of keybase? You import it as with any other key, "decrypt from clipboard" in your favorite manager, or similar.

> How do I know if that's your latest key?

I don't know, how do you know that with a keyserver?

> Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog?

Again, same as any other keyserver.

> THERE MUST BE AN EASIER WAY!

It seems that the frustration is with the PGP client, rather than keybase or the server, though.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#52

Post by quchen »

If anyone wants in, here are 5 invite links.

[Edit: all used up.]

Each works for only one signup, so hurry up :-)

By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#53

Post by WorldMaker »

snassar wrote: post #28
akerro wrote: post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

I don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "g…

«I don't really get what keybase.io is supposed to solve»

Keybase was built to solve the "web of trust" bootstrap problem [1] by leveraging the web of social media profiles a user typically has with simple replicable proofs of social media identity.

[1] Arguably the hardest problem in PKI: how do you get user to trust that a public key is for the right person? In the classic PGP/GPG web of trust you do things like "key signing parties" and physical in real life interactions and deciding your threshold for how far you trust the friend of my friend signed this key. In the Keybase model you can see that the key (or family of keys) are tied to a certain combo of Twitter, Facebook, HN, et al accounts/profiles and generally trust that the person with all those accounts is the person you are trying to communicate with.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#54

Post by madssj »

quchen wrote: post #52

If anyone wants in, here are 5 invite links. [Edit: all used up.] Each works for only one signup, so hurry up :-) By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?

And should they run dry, here are some more invites:

Edit: 25 people from HN now have a keybase account.

Should anyone care, you can use:

  $.makeArray($("input.form-control[value]").map(function() {return $(this).val();})).join(" ")
To produce a list of your active invites from the invite page.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#55

Post by eeeeeeeeeeeee »

akerro wrote: post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

Just because something is useless to you does not mean it's useless to everyone else. There are clearly a lot of people using Keybase.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#57

Post by mi100hael »

zeveb wrote: post #56

Displaying the signature in the web UI is actually the only feature from GitHub I miss when using GitLab. It's not a huge deal, but it gives me a warm-and-fuzzy.

It's on their roadmap: https://gitlab.com/gitlab-org/gitlab-ce/issues/4232

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#58

Post by shadowfacts »

quchen wrote: post #52

If anyone wants in, here are 5 invite links. [Edit: all used up.] Each works for only one signup, so hurry up :-) By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?

I got the second one and just finished setting it up, thanks!

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#59

Post by mi100hael »

rietta wrote: post #35

But what do you do with the signatures on the signed commits? It is of some, limited value, to GPG sign because it does provide a little bit more of "John Hancock" for a release, but how does this work in a continuous integration environment? Does the CI server reject commits that are not properly signed? Does the server refuse to run unsigned or incorrectly signed Git deployed code?

It provides a confirmation that the person who's name & email are on a commit actually made the commit. I can configure my instance of git to make commits as "Linus Torvalds ", but only the real Linus can sign them with a publicly-verifiable GPG key.
Post reply on HN