git@vger.kernel.org list mirror (unofficial, one of many)
 help / color / mirror / code / Atom feed
From: Ethan Rahn <erahn@arista.com>
To: git@vger.kernel.org
Subject: Enterprise wide Git commit signing
Date: Thu, 10 Sep 2020 12:16:56 -0700	[thread overview]
Message-ID: <CAMk6QYPgC1ch_umvGvYRa8F97iY6ynO-ApYC8zHwGzPY3TauDg@mail.gmail.com> (raw)

Hello Git Users,

My name is Ethan Rahn and I lead Product Security at Arista Networks.
I recently completed work on a project which I wanted to highlight for
everyone on this list. This is a means for allowing an enterprise to
centrally manage code signing keys for all engineers, enforce the
signing of all git commits, and audit that the source code repository
was not altered after signing. You can read the full blog post here:
https://eos.arista.com/commit-signing-with-git-at-enterprise-scale/ .
Part of what makes this so exciting to me is that I haven't seen
commit signing done at this level before, especially not with having
the repo be auditable after the fact. By having the repo be auditable
the level of vulnerable infrastructure can be reduced to the code
signing keystore; in other words the code repository can be validated
at any time to ensure it was not tampered with.

I think that the work done here is very interesting because I have not
seen it done elsewhere. Supply chain attacks through source code
repositories are a real problem. The solution in most cases seems to
be setting up a security perimeter around the repository and checking
for unauthorized accesses. If an unauthorized access does occur, or
credentials are stolen, it is hard to know the complete set of
unauthorized changes made, especially if they are mixed with
legitimate work of a number of users over a period of time.

Happy to answer any questions around this or take comments. The work
around key management has been open sourced ( references in the blog
post ) so that the open source community can benefit from this.

Cheers,

Ethan

             reply	other threads:[~2020-09-10 19:18 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-10 19:16 Ethan Rahn [this message]
2020-09-13 14:48 ` Christian Couder

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: http://vger.kernel.org/majordomo-info.html

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAMk6QYPgC1ch_umvGvYRa8F97iY6ynO-ApYC8zHwGzPY3TauDg@mail.gmail.com \
    --to=erahn@arista.com \
    --cc=git@vger.kernel.org \
    --subject='Re: Enterprise wide Git commit signing' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Code repositories for project(s) associated with this inbox:

	https://80x24.org/mirrors/git.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).