RE: [RFE] Signing using SSL

From: rsbecker@nexbridge.com <rsbecker@nexbridge.com>
Date: Mar 16, 2022, 14:49 UTC
Message-ID: <036901d83945$0e9c98a0$2bd5c9e0$@nexbridge.com>
In-Reply-To: <036701d83942$e6963ca0$b3c2b5e0$@nexbridge.com>

On March 16, 2022 10:34 AM, I forgot to mention:

>Following up on our IRC discussion on Monday, I have had a request to

support

>signing git commits and tags with SSL certificates instead of SSH/GPG. The
>organization is heavily invested in SSL infrastructure, so they want to go

down that

Show 8 quoted lines

>path.
>
>The basic technique for doing this is, for example:
>
>openssl dgst -sha256 -sign key -out content.sha256 signature.txt -passin
>passphrase
>
>There is a pre-step to compute the sha256, in this example, into a file

provided to

Show 5 quoted lines

>openssl. We could use openssl to compute the hash also.
>
>Verification is a bit different than what SSH or GPG does:
>
>openssl dgst -sha256 -verify  <(openssl x509 -in certificate -pubkey

-noout) -

Show 11 quoted lines

>signature sign.txt.sha256 signature.txt
>
>and reports either
>
>Verified OK
>Or
>Verification Failure
>
>It does not look like completion codes are consistently involved.
>
>This also does look structurally different than both GPG and SSH and more

work to

>set up. It may be possible to provide wrappers and pretend we are in SSH,

but I'm

>not sure that is the right path to take.
>
>Any pointers on how this might be done in existing git infrastructure, or

should I

>look into making this work in code? Sorry to say that the documentation is

not that

>clear on this.

It looks like there probably needs to be come configuration support including things like httpVerify=false for self-signed certs, certificate store paths, etc., to support SSL infrastructure.