{"thread":{"id":"45365","subject":"[ANNOUNCE] git-sign, simple scripts to generate and verify securely signed Git checkouts","startedAt":"2017-03-13T14:22:12Z","lastAt":"2017-03-13T14:22:12Z","messageCount":1,"participants":["Christian Jaeger"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"313892","messageId":"CAEjYwfWP50JGd7HmP4hVq=Fob3nV0xqc9AuJ0wHreq4HTeSsWw@mail.gmail.com","threadId":"45365","inReplyTo":null,"subject":"[ANNOUNCE] git-sign, simple scripts to generate and verify securely signed Git checkouts","fromName":"Christian Jaeger","fromEmail":"chrjae@gmail.com","sentAt":"2017-03-13T14:22:05Z","receivedAt":"2017-03-13T14:22:12Z","isPatch":false,"sender":{"key":"chrjae@gmail.com","avatar":null},"body":"Hi\n\nMostly as a proof of concept, I've created two scripts to sign and\nverify Git checkouts (I'm saying checkouts since it (both for\nsimplicity, and probably trust) is based on the working directory\ncontents, not the tree referred to by the signed commit). Like some\nother such solutions, this adds secure hashes to the signed tag\nmessage. There are two drawbacks and one advantage versus other\nsolutions:\n\n- meant for small repositories only (each file in the repository takes\nup a line in the tag message)\n- relatively hacky, e.g. newlines in file names may be problematic,\ndoesn't currently use gpg's --status-fd or --with-colons, and doesn't\ncheck git config\n+ easily verifiable scripts, checking can even be done manually (hence\nno need for casual users to (blindly) trust third party code)\n\nhttps://github.com/pflanze/git-sign\n\nChristian.\n"}]}