💡 Motivation

📣 Prerequisites • 💡 Motivation • 🎒 Exercises • 🚀 Beyond • 📚 Resources

Outcomes

In this exercise, the importance of code signing is explored including:

the nature of the problem

relevance to broader security concerns

Nature of the problem

Which of these 2 pull requests would you accept?

Due to the decentralized nature of Git, authenticity can only be established by signing changes, which involves capturing the additional gpgsig header information with commit or tag Git objects¹:

~/simplify-signing-with-ssh (main) $ git log
commit d7a327072ed28cb660924d903ae7c3c22f6c13d1 (HEAD -> main)
Good "git" signature for andyfeller@github.com with ED25519 key SHA256:cX/wtIPgTMgycKw3xFBE9xkJXM+K+t4KzifsuBKxexo
Merge: 25c3e34 a512451
Author: Andy Feller <andyfeller@github.com>
Date:   Sun Aug 28 13:25:48 2022 -0400

    Merge branch 'main' of github.com:git-merge-workshops/simplify-signing-with-ssh


~/simplify-signing-with-ssh (main) $ git cat-file -p d7a327072ed28cb660924d903ae7c3c22f6c13d1
tree 1a0ea28e98cc913b83a26347cab3e0df98a36ece
parent 25c3e34e22861e7bef8d5f177ea8809d8f547068
parent a5124518546d6680626d806c36085099333fac4c
author Andy Feller <andyfeller@github.com> 1661707548 -0400
committer Andy Feller <andyfeller@github.com> 1661707548 -0400
gpgsig -----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgAuowLNeV7cU7+ho4jLGSa61imG
 JnxMf652Yfgxz9rVUAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
 AAAAQDHypmlmi0bdrpWD6T5kllYQwSTKcfcQuFog7SuinZ3/tMAAt1zDXba1Ua0KvIigAQ
 nHX5FueI8ze7p0wPKN0gY=
 -----END SSH SIGNATURE-----

Merge branch 'main' of github.com:git-merge-workshops/simplify-signing-with-ssh

Broader security concerns

Our reliance on software and the increasingly complex ways that changes are authored have raised the need to secure our supply chains.

In the May 2021, the White House released the "Executive Order on Improving the Nation’s Cybersecurity²" executive order, which contains a section "Enhancing Software Supply Chain Security" stating:

4.e.iii

employing automated tools, or comparable processes, to maintain trusted source code supply chains, thereby ensuring the integrity of the code;
4.e.vi

maintaining accurate and up-to-date data, provenance (i.e., origin) of software code or components, and controls on internal and third-party software components, tools, and services present in software development processes, and performing audits and enforcement of these controls on a recurring basis;
4.e.x

ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software used within any portion of a product.

Git 2.34.0 introduces SSH signing

On November 15th 2021, Git 2.34.0 was released with much real estate focused on support sparse indexes, multi-pack reachability bitmaps, and a new default merge strategy.

However in the tidbits section, we heard about support for SSH signing as an alternative to existing signing approaches:

But the experience of using GPG and maintaining keys can be somewhat cumbersome. One alternative is to use a new feature of OpenSSH (released back in OpenSSH 8.0) that allows using the SSH key you likely already have as a signing key.

Expanding existing signing support for GPG³ and X509⁴ signing, SSH signing support is aimed at lowering barriers to improved code authenticity.

Next: Setup workstation

FilesExpand file tree

motivation.md

Latest commit

History