blog

forgeless-ssh-signed-commit.xml (2649B)

<!--
Copyright © 2014 Haelwenn (lanodan) Monnier
SPDX-License-Identifier: LAL-1.3
-->
<entry>
<title>Forge-less SSH-signed git commits</title>
<link rel="alternate" type="text/html" href="https://hacktivis.me/articles/forgeless-ssh-signed-commit"/>
<id>https://hacktivis.me/articles/forgeless-ssh-signed-commit</id>
<published>2025-05-02T06:43:26Z</published>
<updated>2025-05-02T06:43:26Z</updated>
<!--
<link rel="external replies" type="application/activity+json" href="https://queer.hacktivis.me/objects/50be9d37-dee6-4c69-818e-013fa3b010d0" />
<link rel="external replies" type="text/html" href="https://queer.hacktivis.me/objects/50be9d37-dee6-4c69-818e-013fa3b010d0" />
-->
<content type="xhtml">
<div xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
<p>
	One key difference I found useful when git added support for ssh-signature is the fact that you now can just drop an <code>authorized_keys</code> file in the repository, and configure it as a source of public keys.<br />
	No more horribly unreliable OpenPGP keyservers where getting trust is rather questionable (<a href="https://hacktivis.me/articles/real%20names">ID Cards are for citizenship and border-control</a>), and no more "Verified" badge in forges that you can't check yourself.
</p>
<p>
	For this you want a file in the repository containing the git email followed by the ssh-public key, and set it as a trusted source via <code>gpg.ssh.allowedSignersFile</code>, like so with naming it <code>authorized_keys.git</code>:
<code><pre>
# How to setup: git config gpg.ssh.allowedSignersFile authorized_keys.git
contact@hacktivis.me ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKAxeQh6KJGg89yivTtmUtjxp80inHBrL5sMdt+Kg1ed haelwenn@NightmareMoon
contact@hacktivis.me ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6LRxSNagh9NlEYLUqA8o/4HiUStEymeyvjFtNZeEIe haelwenn@cloudchaser
</pre></code>
	<br />
	As can be seen in <a href="https://hacktivis.me/git/utils-std/file/authorized_keys.git.html">utils-std's <code>authorized_keys.git</code></a>.
</p>
<p>
	This way everyone with a copy of the git repository can verify the commit signatures on their own, entirely offline.
	And there is also a much clearer link between the keys and repository identity.
</p>
<p>
	One thing I haven't done but would be interesting is verifying said signatures via git-hooks when new commits are pulled, meaning that keys needs to be added by someone already authorized.<br />
	<a href="https://guix.gnu.org/en/blog/2024/authenticate-your-git-checkouts/">Guix has done something like this</a>, but sadly it's lispy and built into the guix ecosystem.
</p>
</div>
</content>
</entry>