trust anchor is the certificate authority not a verified key
no specific key uploaded by the user
verification status could be one of the following
verified: email within x509 certificate equals committer email and ca is trusted
unverified: email within x509 certificate does not match committer email or ca is not trusted or signature invalid
verification can be done using plain OpenSSL functionality or via gpgsm
my initial approach was using gpgsm, however the formats and concepts of x509 and gpg keys differ heavily and requires a lot of workarounds when using gpgsm, beside of the additional complexity at the code level gpp does require a lot of local configuration. This will make it error prone and reduce the operatability significantly
the openssl native approach is much simpler from an implementation, maintenance and operations point of view
Approach:
add a new Gitlab::SignedCommit class containing has_signature?, signature_type and signature_data extract function
add a new Gitlab::X509::Commit class similar to Gitlab::Gpg::Commit
verify x509 signature using OpenSSL and the default certs ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE'
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
Label as security and @ mention @gitlab-com/gl-security/appsec
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
Security reports checked/validated by a reviewer from the AppSec team
