git@vger.kernel.org list mirror (unofficial, one of many)
 help / color / mirror / Atom feed
* Enterprise wide Git commit signing
@ 2020-09-10 19:16 Ethan Rahn
  2020-09-13 14:48 ` Christian Couder
  0 siblings, 1 reply; 2+ messages in thread
From: Ethan Rahn @ 2020-09-10 19:16 UTC (permalink / raw)
  To: git

Hello Git Users,

My name is Ethan Rahn and I lead Product Security at Arista Networks.
I recently completed work on a project which I wanted to highlight for
everyone on this list. This is a means for allowing an enterprise to
centrally manage code signing keys for all engineers, enforce the
signing of all git commits, and audit that the source code repository
was not altered after signing. You can read the full blog post here:
https://eos.arista.com/commit-signing-with-git-at-enterprise-scale/ .
Part of what makes this so exciting to me is that I haven't seen
commit signing done at this level before, especially not with having
the repo be auditable after the fact. By having the repo be auditable
the level of vulnerable infrastructure can be reduced to the code
signing keystore; in other words the code repository can be validated
at any time to ensure it was not tampered with.

I think that the work done here is very interesting because I have not
seen it done elsewhere. Supply chain attacks through source code
repositories are a real problem. The solution in most cases seems to
be setting up a security perimeter around the repository and checking
for unauthorized accesses. If an unauthorized access does occur, or
credentials are stolen, it is hard to know the complete set of
unauthorized changes made, especially if they are mixed with
legitimate work of a number of users over a period of time.

Happy to answer any questions around this or take comments. The work
around key management has been open sourced ( references in the blog
post ) so that the open source community can benefit from this.

Cheers,

Ethan

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Enterprise wide Git commit signing
  2020-09-10 19:16 Enterprise wide Git commit signing Ethan Rahn
@ 2020-09-13 14:48 ` Christian Couder
  0 siblings, 0 replies; 2+ messages in thread
From: Christian Couder @ 2020-09-13 14:48 UTC (permalink / raw)
  To: Ethan Rahn; +Cc: git

Hi,

On Thu, Sep 10, 2020 at 9:19 PM Ethan Rahn <erahn@arista.com> wrote:

> My name is Ethan Rahn and I lead Product Security at Arista Networks.
> I recently completed work on a project which I wanted to highlight for
> everyone on this list.

Thanks for the news!

Maybe you want to add a link to your tool and blog post to the "Git
tools and sites" section of the next Git Rev News edition:

https://github.com/git/git.github.io/issues/455

Best,
Christian.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2020-09-13 14:49 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-10 19:16 Enterprise wide Git commit signing Ethan Rahn
2020-09-13 14:48 ` Christian Couder

git@vger.kernel.org list mirror (unofficial, one of many)

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://public-inbox.org/git
	git clone --mirror http://ou63pmih66umazou.onion/git
	git clone --mirror http://czquwvybam4bgbro.onion/git
	git clone --mirror http://hjrcffqmbrq6wope.onion/git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V1 git git/ https://public-inbox.org/git \
		git@vger.kernel.org
	public-inbox-index git

Example config snippet for mirrors.
Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.version-control.git
	nntp://ou63pmih66umazou.onion/inbox.comp.version-control.git
	nntp://czquwvybam4bgbro.onion/inbox.comp.version-control.git
	nntp://hjrcffqmbrq6wope.onion/inbox.comp.version-control.git
	nntp://news.gmane.io/gmane.comp.version-control.git
 note: .onion URLs require Tor: https://www.torproject.org/

code repositories for the project(s) associated with this inbox:

	https://80x24.org/mirrors/git.git

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git