Re: gitsigur for protecting git repo integrity

["Frank Ch. Eigler" <fche@elastic.org>]

Hi -

> I'd like to share a little gadget I've been working on recently.
> 
> It's a prototype git server hook for allowing participating projects
> to check and/or enforce that commits to certain branches of
> shared-access git repos such as those on sourceware are properly
> gpg-signed.  [...]

Some questions have arisen offline about the relationship of this
script to systems such as sigstore and b4.  Here's a rough comparison
of the three.  This is pretty terse point-by-point analysis.  I'd be
happy to elaborate on any aspect of it.

tl;dr: Overall, it turns out to be more of a composition situation
rather than competition.


Sources: [lines-of-source language]

* gitsigur:  https://sourceware.org/git/gitsigur.git  [200 python]

* sigstore:  https://github.com/sigstore/gitsign, /rekor, /fulcio [73000 go]

* b4:        https://github.com/mricon/b4 [8500 python]


Scope:

* gitsigur:  enforcement of gpg-signed git commits at git server;
             keyring storage in some git repo

* sigstore:  developer-side git signature tooling, via custom
             temporary x509 certificates bound to a web openid identity

* b4:        signed/secure git commit text transport over email


Scope overlap:

* gitsigur/b4: none, though the signed git commit message can include the
               public-inbox url for authenticating the chain of custody

* sigstore/b4: ditto

* gitsigur/sigstore: use of gpg vs custom signatures on git commits
                     (nb: sigstore upstream development uses github's
                     server-side gpg signatures, does not eat sigstore
                     dog-food itself)

* gitsigur/gitlab: signing same, verification analogous 
  https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/index.html
  https://docs.gitlab.com/ee/user/project/repository/push_rules.html

* gitsigur/github: signing same, verification analogous
  https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key
  https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches


Infrastructure required:

* gitsigur:  a git server

* sigstore:  an openid web server, a certificate generator web server,
             audit trail web server, timestamp server

* b4:        a public-inbox email server


Developer workflow - pushing code:

* gitsigur:  create & share gpg key once, use builtin git gpg support
             to sign locally; normal git push to pass gitsigur
             enforcing/permissive gate hook

* sigstore:  install "gitsign" as replacement git signing/crypto
             engine; use openid web system to authenticate against
             some identity server; public certificate generator system
             creates temp certificate; custom git commit signature
             scheme includes entire temp certificate abeam the
             signature itself; git commit news may be broadcast to
             audit trail; normal git push, no server-side gating hook

* b4:        developer posts git patches with b4 wrapper to add gpg
             signature; maintainer uses b4 wrapper to check integrity of
             emailed patch series; normal git commit & push


Developer workflow - verifying commits from git repo:

* gitsigur:  download keyring git repo; run gitsigur locally against
             range of commits

* sigstore:  run gitsign verify on local repo, with the certificate
             keyring stored right within the commits; also possibly
             connecting with public audit trail servers

* b4:        not applicable


Hosting git server workflow:

* gitsigur:  one git update hook

* sigstore:  not applicable as server-side gating does not appear to be part of sigstore

* b4:        not applicable


Composition possibilities:

* gitsigur/b4:  use b4 to send/receive patches by email, gpg-sign resulting
                commit and enforce at server side via gitsigur

* gitsigur/sigstore:  use sigstore to sign commits; teach gitsigur to detect
                      sigstore flavoured signatures and delegate verification
                      to sigstore gitsign, then enforce policy similarly 

* gitsigur/sigstore 2: teach gitsigur to announce receipt of verified commits
                       to sigstore (rekor) public audit-trail

* gitsigur/ssh/x509:  extend gitsigur to support ssh and x509 standard
                      git signature styles, let developers choose
                      their favorite; store keys/certs in same
                      keygitrepo


- FChE