list mirror (unofficial, one of many)
 help / color / mirror / code / Atom feed
* Enterprise wide Git commit signing
@ 2020-09-10 19:16 Ethan Rahn
  2020-09-13 14:48 ` Christian Couder
  0 siblings, 1 reply; 2+ messages in thread
From: Ethan Rahn @ 2020-09-10 19:16 UTC (permalink / raw)
  To: git

Hello Git Users,

My name is Ethan Rahn and I lead Product Security at Arista Networks.
I recently completed work on a project which I wanted to highlight for
everyone on this list. This is a means for allowing an enterprise to
centrally manage code signing keys for all engineers, enforce the
signing of all git commits, and audit that the source code repository
was not altered after signing. You can read the full blog post here: .
Part of what makes this so exciting to me is that I haven't seen
commit signing done at this level before, especially not with having
the repo be auditable after the fact. By having the repo be auditable
the level of vulnerable infrastructure can be reduced to the code
signing keystore; in other words the code repository can be validated
at any time to ensure it was not tampered with.

I think that the work done here is very interesting because I have not
seen it done elsewhere. Supply chain attacks through source code
repositories are a real problem. The solution in most cases seems to
be setting up a security perimeter around the repository and checking
for unauthorized accesses. If an unauthorized access does occur, or
credentials are stolen, it is hard to know the complete set of
unauthorized changes made, especially if they are mixed with
legitimate work of a number of users over a period of time.

Happy to answer any questions around this or take comments. The work
around key management has been open sourced ( references in the blog
post ) so that the open source community can benefit from this.



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2020-09-13 14:49 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-10 19:16 Enterprise wide Git commit signing Ethan Rahn
2020-09-13 14:48 ` Christian Couder

Code repositories for project(s) associated with this inbox:

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).