{"thread":{"id":"54223","subject":"Enterprise wide Git commit signing","startedAt":"2020-09-10T19:18:07Z","lastAt":"2020-09-13T14:48:43Z","messageCount":2,"participants":["Ethan Rahn","Christian Couder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"405364","messageId":"CAMk6QYPgC1ch_umvGvYRa8F97iY6ynO-ApYC8zHwGzPY3TauDg@mail.gmail.com","threadId":"54223","inReplyTo":null,"subject":"Enterprise wide Git commit signing","fromName":"Ethan Rahn","fromEmail":"erahn@arista.com","sentAt":"2020-09-10T19:16:56Z","receivedAt":"2020-09-10T19:18:07Z","isPatch":false,"sender":{"key":"erahn@arista.com","avatar":null},"body":"Hello Git Users,\n\nMy name is Ethan Rahn and I lead Product Security at Arista Networks.\nI recently completed work on a project which I wanted to highlight for\neveryone on this list. This is a means for allowing an enterprise to\ncentrally manage code signing keys for all engineers, enforce the\nsigning of all git commits, and audit that the source code repository\nwas not altered after signing. You can read the full blog post here:\nhttps://eos.arista.com/commit-signing-with-git-at-enterprise-scale/ .\nPart of what makes this so exciting to me is that I haven't seen\ncommit signing done at this level before, especially not with having\nthe repo be auditable after the fact. By having the repo be auditable\nthe level of vulnerable infrastructure can be reduced to the code\nsigning keystore; in other words the code repository can be validated\nat any time to ensure it was not tampered with.\n\nI think that the work done here is very interesting because I have not\nseen it done elsewhere. Supply chain attacks through source code\nrepositories are a real problem. The solution in most cases seems to\nbe setting up a security perimeter around the repository and checking\nfor unauthorized accesses. If an unauthorized access does occur, or\ncredentials are stolen, it is hard to know the complete set of\nunauthorized changes made, especially if they are mixed with\nlegitimate work of a number of users over a period of time.\n\nHappy to answer any questions around this or take comments. The work\naround key management has been open sourced ( references in the blog\npost ) so that the open source community can benefit from this.\n\nCheers,\n\nEthan\n"},{"id":"405490","messageId":"CAP8UFD1kiqJATVSnFSWueVR7ms=SVr=9UJoYQPp0+4ZDTKknXA@mail.gmail.com","threadId":"54223","inReplyTo":"CAMk6QYPgC1ch_umvGvYRa8F97iY6ynO-ApYC8zHwGzPY3TauDg@mail.gmail.com","subject":"Re: Enterprise wide Git commit signing","fromName":"Christian Couder","fromEmail":"christian.couder@gmail.com","sentAt":"2020-09-13T14:48:22Z","receivedAt":"2020-09-13T14:48:43Z","isPatch":false,"sender":{"key":"christian.couder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/208954?v=4"},"body":"Hi,\n\nOn Thu, Sep 10, 2020 at 9:19 PM Ethan Rahn <erahn@arista.com> wrote:\n\n> My name is Ethan Rahn and I lead Product Security at Arista Networks.\n> I recently completed work on a project which I wanted to highlight for\n> everyone on this list.\n\nThanks for the news!\n\nMaybe you want to add a link to your tool and blog post to the \"Git\ntools and sites\" section of the next Git Rev News edition:\n\nhttps://github.com/git/git.github.io/issues/455\n\nBest,\nChristian.\n"}]}