Skip to content

Show verification badge for commits signed by a certificate

Igor Drozdov requested to merge id-ssh-certificates-commit-signing into master

What does this MR do and why?

With SSH certificates initiative we've added the ability to authenticate using SSH certificates. However, it's also possible to sign commits using the certificates.

This MR adds the ability to recognize the signed commits and show a badge according to the verification status.

When a certificate is passed via -f option to ssh-keygen utility:

ssh-keygen -Y sign -f id_ed25519-cert.pub -n git message.txt

It puts the certificate as a public key information into the signature. We can use that information to verify the signature and associate it with CA configured in a group.

Related issue: Sign commits using SSH certificates (#435648 - closed)

Steps

  1. Enable enforce_ssh_certificates_via_settings and ssh_certificates_rest_endpoints feature flags
  2. Configure the user to be an Enterprise user or just disable this line in code
  3. Generate CA: ssh-keygen -f CA -t ed25519
  4. Add CA.pub file to the a top-level group in rails c:
Groups::SshCertificates::CreateService.new(<top-level-group>, { key: <content-of-CA.pub>, title: 'ED25519 key' }, User.first).execute
  1. Issue a certificate: ssh-keygen -s CA -I admin@example.com -V +1d ~/.ssh/id_ed25519.pub, where admin@example.com is the email of your committer and ~/.ssh/id_ed25519.pub is the path to the public part of your signing SSH key
  2. Configure Git to sign commits using your SSH certificate:
[user]
...
	signingkey = /Users/.../.ssh/id_ed25519-cert.pub
[gpg]
	format = ssh
[commit]
	gpgsign = true
  1. Create a commit and push
  2. Verified label appears near your commit in GitLab (screenshot below)

Screenshots

Screenshot_2023-12-18_at_14.34.43

Edited by Igor Drozdov

Merge request reports