Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Don't jump in without reviewing the caveats:

* Not supported as "verified" in the GitHub UI [edit: mostly as opposed to "the main reason to try it"]

* A public transparency log "which may include user emails or repo identifiers"



I don't consider "verified" in the GitHub UI as safe to rely on.

If you forge a commit from Linus Torvalds, where Joe Blow is the co-author, as long as Joe Blow GPG signed the commit it will show "Verified" with no distinction indicating Linus did not.

This combined with other issues I reported to GitHub like this[0] ('working as intended', but now thankfully fixed because it blew up on Twitter months later) makes me think GitHub doesn't care to invest a whole lot in commit verification stuff.

[0] https://news.ycombinator.com/item?id=24977398


I agree that GitHub "verified" does seem to be mostly for show right now, thanks for emphasizing that.

My point was more that the show (which many would consider using it for) isn't even working yet for this project.


GitHub will only let you add a GPG key if you have verified your email address.

So, yes you can of course have Verified name spoofing, but at least the email in git commits can be trusted.


The "verified" checkmark in GitHub UI is not really a big reassurance. Someone can steal your private key, continue to use it and still be verified until you or someone else notices and revokes the key.

GitHub, for example, has their own GPG key as verified for commits you author on their UI. In this case, you're trusting GitHub –and GitHub can also mark sigstore certificates as verified as well (they should), as they're actually verifiable using a transparency log.

What sigstore really brings to the picture is the attestation of "whoever signed this commit was actually signed into the github account @foo –or google account bar@google.com at the time, and here's the proof in a transparency log" –and those accounts can be secured by 2FA. It also takes you out of GPG key management business which I personally despise.


GitHub just needs support for SSH-based commit signing.

https://calebhearth.com/sign-git-with-ssh


There is a discussion about the lack of support here -

(https://github.com/github-community/community/discussions/77... - released by end of June)


We're working on fixes for both of those issues!


smimesign supports timestamping with a normal timestamp server, with a bit of extra effort. It would be cool if your tool could (at least optionally) do the same as an alternative to your custom transparency log.

https://github.com/github/smimesign/issues/47#issuecomment-4...


We used to actually run an RFC3161 timestamp server in addition to the transparency log but recently turned it down because no one was using it. I'd like to bring it back for stuff like this.

https://github.com/sigstore/gitsign/issues/22




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: