adds SSH signature validation for git commits by bb-Ricardo · Pull Request #1141 · fluxcd/pkg

bb-Ricardo · 2026-02-27T12:04:07Z

This PR adds support of SSH signature validation.

adds new package git/signatures
adds validation of SSH signed commits to ssh_signature.go
moves GPG signature validation to gpg_signature.go
adds text fixtures for all SSH and GPG key types including commits and signatures
adds tests for all key/signature combinations
adds wrapper for "Verify(keyRings ...string)" function

- adds new package git/signatures - adds validation of SSH signed commits to ssh_signature.go - moves GPG signature validation to gpg_signature.go - adds text fixtures for all SSH and GPG key types including commits and signatures - adds tests for all key/signature combinations - adds wrapper for "Verify(keyRings ...string)" function Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

stefanprodan · 2026-02-28T08:04:40Z

@bb-Ricardo please run make tidy and force push to unblock the test.

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

stefanprodan · 2026-02-28T09:56:07Z

git/signatures/ssh_signature.go

+// in the format used by SSH (e.g., "SHA256:abc123...").
+func GetPublicKeyFingerprint(pubKey gossh.PublicKey) string {
+	hash := sha256.Sum256(pubKey.Marshal())
+	return "SHA256:" + strings.TrimSuffix(base64.StdEncoding.EncodeToString(hash[:]), "=")


Maybe use base64.RawStdEncoding which omits padding entirely.

thank you, will change it accordingly.

has been fixed

stefanprodan · 2026-02-28T09:58:04Z

git/signatures/signature.go

+
+// Isx509Signature tests if the given signature is of type x509.
+// It returns true if the signature starts with the x509 signature prefix.
+func Isx509Signature(signature string) bool {


Suggested change

func Isx509Signature(signature string) bool {

func IsX509Signature(signature string) bool {

We do not support X509, why have this code here?

This is a place holder / compatibility implementation:

to embed the signature type into the error message to inform the user about the wrong type of signature

it is planned to implement x509 signature validation as well: Feature Request: support validation of additional git commit signature types source-controller#1996

Ok can you please add a comment and explain all of this. Also normalize the naming instead of Isx should be IsX .

Sure, will do that. So due to the CameCasing the x in x509 would be capitalized?

In general, these functions should be implemented in go-git but this is currently not the case. But the discussion about the git signature validation improvements are already ongoing.

changed all occurrences

stefanprodan · 2026-02-28T10:04:12Z

git/signatures/ssh_signature.go

+					return GetPublicKeyFingerprint(pubKey), nil
+				}
+			}
+		}


The hash algo is specified in the SSH signature. So instead of trying both algos, we can do:

err := sshsig.Verify(bytes.NewReader(payload), sig, pubKey, sig.HashAlgorithm, "git") if err == nil { return GetPublicKeyFingerprint(pubKey), nil }

thank you, will have a look into changing it.

stefanprodan · 2026-02-28T10:38:33Z

git/signatures/ssh_signature_test.go

+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sig, err := sshsig.Unarmor([]byte(tt.sig))


Why are we testing sshsig here? call VerifySSHSignature or ParseAuthorizedKeys instead?

Test cases have been combined and redundant tests have been removed.

stefanprodan · 2026-02-28T10:41:21Z

git/signatures/ssh_signature_test.go

+	})
+}
+
+func TestVerifySSHSignatureAllKeyTypes(t *testing.T) {


This looks like a duplicate of TestVerifySSHSignature, if you delete it, does the test coverage drops?

stefanprodan · 2026-02-28T10:42:41Z

git/signatures/ssh_signature.go

+
+// getPublicKeyFingerprint returns the SHA256 fingerprint of the public key
+// in the format used by SSH (e.g., "SHA256:abc123...").
+func GetPublicKeyFingerprint(pubKey gossh.PublicKey) string {


Do we need to export this?

I wanted to use BuildCommitWithRef from clone. But to avoid circular dependencies, I needed to make this function public. I could put the test for the fingerprints into a separate test package to avoid that. Otherwise I would need to reimplement the behaviour of BuildCommitWithRef mockup, but wanted to avoid that to get some meaningful test results.

I have split the test packages and now the function is not exported anymore.

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

bb-Ricardo requested review from aryan9600 and hiddeco as code owners February 27, 2026 12:04

bb-Ricardo force-pushed the rb-feature/adds-ssh-signature-validation branch from f814194 to 394fe64 Compare February 27, 2026 12:10

bb-Ricardo added 3 commits February 27, 2026 20:00

adds validation of key fingerprint string

d933255

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

adds better git signature detection format

190f9c9

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

adds detection for added signature prefixes

0b468bf

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

bb-Ricardo force-pushed the rb-feature/adds-ssh-signature-validation branch from 96523af to 1561774 Compare February 28, 2026 00:35

bb-Ricardo requested a review from a team as a code owner February 28, 2026 08:48

adds tests for git.go

048e862

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

bb-Ricardo force-pushed the rb-feature/adds-ssh-signature-validation branch from eedb46c to 048e862 Compare February 28, 2026 09:07

bb-Ricardo mentioned this pull request Feb 28, 2026

Improve UX for verifying commits and Tags go-git/go-git#1869

Open

2 tasks

stefanprodan reviewed Feb 28, 2026

View reviewed changes

bb-Ricardo mentioned this pull request Feb 28, 2026

Feature Request: support validation of additional git commit signature types fluxcd/source-controller#1996

Open

stefanprodan reviewed Feb 28, 2026

View reviewed changes

bb-Ricardo added 2 commits February 28, 2026 12:55

adds requested changes regarding naming

ad3e595

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

cleans up tests and removed duplicate test files

5e6ab4d

Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>

bb-Ricardo force-pushed the rb-feature/adds-ssh-signature-validation branch from e247a34 to 5e6ab4d Compare March 2, 2026 23:16

	func Isx509Signature(signature string) bool {
	func IsX509Signature(signature string) bool {

Conversation

bb-Ricardo commented Feb 27, 2026

Uh oh!

stefanprodan commented Feb 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stefanprodan Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bb-Ricardo Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bb-Ricardo Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stefanprodan Feb 28, 2026 •

edited

Loading

bb-Ricardo Feb 28, 2026 •

edited

Loading

bb-Ricardo Mar 2, 2026 •

edited

Loading