Re: gitsigur for protecting git repo integrity

[Mark Wielaard <mark@klomp.org>]

Hi all,

Collecting more fediverse replies.

On Tue, Jul 04, 2023 at 10:32:45AM +0200, Mark Wielaard via Overseers wrote:
> On Thu, Jun 29, 2023 at 02:55:06PM -0400, Frank Ch. Eigler via Overseers wrote:
> > > I'd like to share a little gadget I've been working on recently.
> > > 
> > > It's a prototype git server hook for allowing participating projects
> > > to check and/or enforce that commits to certain branches of
> > > shared-access git repos such as those on sourceware are properly
> > > gpg-signed.  [...]
> > 
> > Some questions have arisen offline about the relationship of this
> > script to systems such as sigstore and b4.  Here's a rough comparison
> > of the three.  This is pretty terse point-by-point analysis.  I'd be
> > happy to elaborate on any aspect of it.
> > 
> > tl;dr: Overall, it turns out to be more of a composition situation
> > rather than competition.
> 
> Very nice, this was very helpful.
> 
> On irc we also discussed signed git pushes (which are now also enabled
> on sourceware). Which provides another "layer" of integrity.
> 
> As reply to our fosstodon post
> https://fosstodon.org/@sourceware/110629743586988452 someone from the
> tor project posted an overview of "Git repository integrity solutions"
> they wrote up for their project:
> https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/gitlab#git-repository-integrity-solutions
> 
> It references this discussion, so now I am completing the circle :)

Another reply (CCing the author):
https://toot.aquilenet.fr/@civodul/110658002235937665

  @sourceware To authenticate source code, the mechanism initially
  developed for Guix:

  https://doi.org/10.22152/programming-journal.org/2023/7/1
  https://guix.gnu.org/manual/en/html_node/Invoking-guix-git-authenticate.html

  My understanding is that gitsigur checks signatures against an
  out-of-band list of authorized keys, which isn’t very useful because
  the set of authorized committers changes over time.