Signing Commits

[Roberto Cortez]

Hi everyone,

In the next few days, we will require signing commits to contribute to SR Projects.

If you don’t have that setup, you can do it following the instructions here:

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

We hope that this will improve our security and make sure that the author matches the contributor.

Thanks!

Cheers,

Roberto

[Ladislav Thon]

How about we didn't? Key management is a massive pain. I know of projects that require `git commit -s`, but this is the first time I hear of someone requiring `git commit -S`.

LT

po 14. 3. 2022 v 20:40 odesílatel 'Roberto Cortez' via SmallRye <smal...@googlegroups.com> napsal:

--
You received this message because you are subscribed to the Google Groups "SmallRye" group.
To unsubscribe from this group and stop receiving emails from it, send an email to smallrye+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/smallrye/18529A00-9D96-463B-B107-6291657218D9%40yahoo.com.

[Roberto Cortez]

No need to add -S, just the global setting `git config --global commit.gpgsign true` is enough.

Plus the signing key:

https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key

There are some increasing reports of GH phishing attempts, so I think we should add this extra layer of security.

I set up mine some time ago and it was a one-time thing.

Is this doable for you?

Cheers,

Roberto

To view this discussion on the web visit https://groups.google.com/d/msgid/smallrye/CALbocOmvJYB8_kQ3FKjQJBc_uryZCKLYKGD98hzRicwHdn_PTA%40mail.gmail.com.

[Ladislav Thon]

Hi,

út 15. 3. 2022 v 12:31 odesílatel 'Roberto Cortez' via SmallRye <smal...@googlegroups.com> napsal:

No need to add -S, just the global setting `git config --global commit.gpgsign true` is enough.

yea I know, I was just pointing out that there are two different ways of "signing" commits, and while I've seen one of them to be required by some projects, I haven't yet seen a requirement of the other.

 

Plus the signing key:

https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key

There are some increasing reports of GH phishing attempts, so I think we should add this extra layer of security.

I set up mine some time ago and it was a one-time thing.

Yea that's not a problem. I actually have a GPG key, but when I migrate to a new laptop, I'll probably lose it, just like I already lost several keys, because, ugh, they are just a pain. I'm happy enough that I'm able to keep my SSH key :-) I admit I'm terrible at security and in general try to stay away from private key cryptography if at all possible.

I uploaded my public key to GitHub and configured Git to sign the commits. Let's see how [long] it works :-)

LT

 

To view this discussion on the web visit https://groups.google.com/d/msgid/smallrye/2489CB25-778F-4F2B-9716-9974451CC6F5%40yahoo.com.

[Julien Ponge]

I’ve enabled this last week on Mutiny 😃

[Roberto Cortez]

Thanks :)

To view this discussion on the web visit https://groups.google.com/d/msgid/smallrye/CALbocO%3Da0OizpBN0WsP22pRjEmU7E0ohDj1G7YCTQdBLNE42Ug%40mail.gmail.com.

[Ladislav Thon]

Are you seriously asking why everyone hasn't been GPG-signing their emails for more than 2 decades? :-)

At least from my perspective, user-friendliness is not that big of a deal. Key management and establishing trust are. (The 2nd issue is not a problem, because GitHub is centralized and there's no need to establish a web of trust. The 1st issue remains.)

LT

st 16. 3. 2022 v 13:30 odesílatel Martin Stefanko <xstef...@gmail.com> napsal:

Well, truthfully, I don't understand how anyone is not using this already. And I just set up the key once and then run `git config --global commit.gpgsign true` and I didn't touch it since then. And why? --> https://github.com/xstefank/smallrye-fault-tolerance/commit/d0bc50d85962da34ae560964d0d26f905f73d784 ;).

Martin

To view this discussion on the web visit https://groups.google.com/d/msgid/smallrye/faa490d4-84d6-41c5-a4e5-ac43647c4f56n%40googlegroups.com.