Enterprise wide Git commit signing

[Ethan Rahn <erahn@arista.com>]

Hello Git Users,

My name is Ethan Rahn and I lead Product Security at Arista Networks.
I recently completed work on a project which I wanted to highlight for
everyone on this list. This is a means for allowing an enterprise to
centrally manage code signing keys for all engineers, enforce the
signing of all git commits, and audit that the source code repository
was not altered after signing. You can read the full blog post here:
https://eos.arista.com/commit-signing-with-git-at-enterprise-scale/ .
Part of what makes this so exciting to me is that I haven't seen
commit signing done at this level before, especially not with having
the repo be auditable after the fact. By having the repo be auditable
the level of vulnerable infrastructure can be reduced to the code
signing keystore; in other words the code repository can be validated
at any time to ensure it was not tampered with.

I think that the work done here is very interesting because I have not
seen it done elsewhere. Supply chain attacks through source code
repositories are a real problem. The solution in most cases seems to
be setting up a security perimeter around the repository and checking
for unauthorized accesses. If an unauthorized access does occur, or
credentials are stolen, it is hard to know the complete set of
unauthorized changes made, especially if they are mixed with
legitimate work of a number of users over a period of time.

Happy to answer any questions around this or take comments. The work
around key management has been open sourced ( references in the blog
post ) so that the open source community can benefit from this.

Cheers,

Ethan