From 3fbb2c624ed94a326a7f19f13a12adf78c7dd50f Mon Sep 17 00:00:00 2001 From: Roman Zeyde Date: Fri, 21 Oct 2022 20:41:55 +0300 Subject: [PATCH] Document SSH-based Git signatures --- doc/README-SSH.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/doc/README-SSH.md b/doc/README-SSH.md index 28f306a..a4272ab 100644 --- a/doc/README-SSH.md +++ b/doc/README-SSH.md @@ -114,6 +114,42 @@ The same works for Mercurial (e.g. on [BitBucket](https://confluence.atlassian.c $ ssh-shell $ hg push +### Git commit signing + +For more details, see the following great blog post: https://calebhearth.com/sign-git-with-ssh + + $ trezor-agent -e ed25519 user@host --shell + $ ssh-add -L + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeAmtnhHlyg4dzGP3/OF4WHX7NoYhClS98EK22q/O5+ + $ git config --local user.signingkey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeAmtnhHlyg4dzGP3/OF4WHX7NoYhClS98EK22q/O5+" + $ git config --local gpg.format ssh + $ git config --local commit.gpgsign true + + $ git config --local gpg.ssh.allowedSignersFile $PWD/.git/allowed-signers + $ echo "user@host ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeAmtnhHlyg4dzGP3/OF4WHX7NoYhClS98EK22q/O5+" >> $PWD/.git/allowed-signers + + $ git commit --allow-empty --message="Testing SSH signing" + [master 4a1f730] Testing SSH signing + + $ git log --show-signature -1 + commit 4a1f730d7f70fd31a0bda334734d0ac4dc9d97ad (HEAD -> master) + Good "git" signature for user@host with ED25519 key SHA256:aESFjLsydJHQg1vnAkq42jQDkCcn4Tde4J+v+0XFmwM + Author: Roman Zeyde + Date: Fri Oct 21 18:34:09 2022 +0300 + + Testing SSH signing + + $ cat .git/config + [user] + signingkey = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeAmtnhHlyg4dzGP3/OF4WHX7NoYhClS98EK22q/O5+ + [gpg] + format = ssh + [commit] + gpgsign = true + [gpg "ssh"] + allowedSignersFile = /home/user/Code/test-git-ssh-sig/.git/allowed-signers + + ### Start the agent as a systemd unit ##### 1. Create these files in `~/.config/systemd/user`