Hi - > Would it be possible for gitsigur to support signing commits with ssh > keys as well as gpg? Git supports this, and it's much easier for > everybody than having to set up gpg. [...]
It would save some effort, but OTOH plenty of people have gpg keys too, and the common desktop key agents support both. > We already need an SSH key on sourceware.org to push to Git, so all > those public keys could be treated as trusted (via git config > gpg.ssh.allowedSignersFile). [...] One difference is that gitsigur aims to prevent impersonation, by tying the recorded committer to a designated set of keys for that committer. The git builtin ssh-signing gadget doesn't attempt this. But maybe just a small matter of wrapping might do the job. Filed https://sourceware.org/bugzilla/show_bug.cgi?id=31670 . > I'm already signing my GCC commits that way, without needing to use > gpg or gitsigur: Great, keep it up! Nothing has been stopping people from signing their commits any way they like, including even more complex ways like sigstore. gitsigur verification is not enabled (even in permissive mode) at all for gcc at this time. > commit 7c2a9dbcc2c1cb1563774068c59d5e09edc59f06 [r14-10008-g7c2a9dbcc2c1cb] > Good "git" signature for jwak...@redhat.com with RSA key > SHA256:8rFaYhDWn09c3vjsYIg2JE9aSpcxzTnCqajoKevrUUo Thanks, this will help test a prototype later on. - FChE
