02-sign-verify-commits.md

🎒 Exercise: Signing and verifying commits

Setup workstation • Signing and verifying commits • Signing and verifying merges

Signing commits is where participants begin gaining experience.

As the previous exercise was focused on workstation setup, this exercise has additional content intended to help troubleshoot possible errors that might arise.

Outcomes

In this exercise, the process for signing and verifying commits is covered including:

1. Explicitly sign and verify commits
2. Troubleshooting problems
3. Optional Git configurations to sign and verify all commits

Steps

1. Create workspace repository README explaining its purpose and the exercise we are on

   cat << 'EOF' > README.md
   # My git-merge-workshops/simplify-signing-with-ssh workspace
   
   This repository is my workspace for experimenting with SSH signing keys as a part of [git-merge-workshops/simplify-signing-with-ssh](https://github.com/git-merge-workshops/simplify-signing-with-ssh) where I experimented with the following exercises:
   
   1. [Setup workstation](https://github.com/git-merge-workshops/simplify-signing-with-ssh/blob/main/exercises/01-setup-workstation.md)
   1. [Signing and verifying commits](https://github.com/git-merge-workshops/simplify-signing-with-ssh/blob/main/exercises/02-sign-verify-commits.md)
   1. [Signing and verifying merges](https://github.com/git-merge-workshops/simplify-signing-with-ssh/blob/main/exercises/03-sign-verify-merges.md)
   1. [Signing and verifying tags](https://github.com/git-merge-workshops/simplify-signing-with-ssh/blob/main/exercises/04-sign-verify-tags.md)
   1. [Signing past commits and tags](https://github.com/git-merge-workshops/simplify-signing-with-ssh/blob/main/exercises/05-sign-past-commits-tags.md)
   
   EOF

2. Confirm SSH commit signing is setup correctly

   git add .
   git commit -S -m "Initialize workspace repository README"

   

   Possible results:

   • [main (root-commit) 1451203] Initialize workspace repository README
      1 file changed, 10 insertions(+)
      create mode 100644 README.md
     

     🥳 Congratulations! SSH signing setup including SSH agent is good.

   • error: Load key "/var/folders/xb/svzskj1x77x3qsmwx1d84nqc0000gn/T//.git_signing_key_tmpW0EAyi": invalid format?
     

     😥 Do not to worry! This is error is likely due to:

     1. SSH agent being stopped
     2. SSH private key not being added
     3. mismatch between SSH private and public keys

   For more information about signing commits, see "git commit -S".

3. Verify SSH commit is signed and trusted

   git verify-commit -v HEAD

   resulting in:

   tree 8a370608ce603f2dd863efff4f7cc2401c75d829
   author Andy Feller <andyfeller@github.com> 1662853747 -0400
   committer Andy Feller <andyfeller@github.com> 1662853747 -0400
   
   Initialize workspace repository README
   Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8

   For more information about verifying commits, see "git verify-commit".

4. Confirm logs show SSH commit sign status

   git log --show-signature

   Possible results:

   • Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
     

     🥳 Congratulations! SSH commit verifying setup including SSH agent is good.

   • error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification
     

     😥 Do not to worry! This is error is likely due to missing gpg.ssh.allowedSignersFile configuration above.

   • Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
     /path/to/.ssh/allowed_signers:1: invalid key^M
     sig_find_principals: sshsig_get_principal: key not found^M
     No principal matched.
     

     😥 Do not to worry! This is error is likely due to format of gpg.ssh.allowedSignersFile file as SSH public keys cannot be copied as-is into the file.

   For more information about signatures in logs, see "git log --show-signature".

5. Configure additional SSH commit signing and verifying for workshop repository specifically:

   git config commit.gpgsign true
   git config log.showSignature true

   Note To globally configure SSH signing and verifying, use the --global flag:

   git config --global commit.gpgsign true
   git config --global log.showSignature true

   For more information about these Git configuration options, see commit.gpgSign, log.showSignature.

End of exercise

At the end of this exercise, the repository should look like:

---

Next: Signing and verifying merges