Commits on Sep 10, 2021

1. ssh signing: preliminary refactoring and clean-up …

   Openssh v8.2p1 added some new options to ssh-keygen for signature
   creation and verification. These allow us to use ssh keys for git
   signatures easily.
   
   In our corporate environment we use PIV x509 Certs on Yubikeys for email
   signing/encryption and ssh keys which I think is quite common
   (at least for the email part). This way we can establish the correct
   trust for the SSH Keys without setting up a separate GPG Infrastructure
   (which is still quite painful for users) or implementing x509 signing
   support for git (which lacks good forwarding mechanisms).
   Using ssh agent forwarding makes this feature easily usable in todays
   development environments where code is often checked out in remote VMs / containers.
   In such a setup the keyring & revocationKeyring can be centrally
   generated from the x509 CA information and distributed to the users.
   
   To be able to implement new signing formats this commit:
    - makes the sigc structure more generic by renaming "gpg_output" to
      "output"
    - introduces function pointers in the gpg_format structure to call
      format specific signing and verification functions
    - moves format detection from verify_signed_buffer into the check_signature
      api function and calls the format specific verify
    - renames and wraps sign_buffer to handle format specific signing logic
      as well
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   b5726a5 View commit details

   Browse the repository at this point in the history

2. ssh signing: add test prereqs …

   Generate some ssh keys and a allowedSignersFile for testing
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   64625c7 View commit details

   Browse the repository at this point in the history

3. ssh signing: add ssh key format and signing code …

   Implements the actual sign_buffer_ssh operation and move some shared
   cleanup code into a strbuf function
   
   Set gpg.format = ssh and user.signingkey to either a ssh public key
   string (like from an authorized_keys file), or a ssh key file.
   If the key file or the config value itself contains only a public key
   then the private key needs to be available via ssh-agent.
   
   gpg.ssh.program can be set to an alternative location of ssh-keygen.
   A somewhat recent openssh version (8.2p1+) of ssh-keygen is needed for
   this feature. Since only ssh-keygen is needed it can this way be
   installed seperately without upgrading your system openssh packages.
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   29b3157 View commit details

   Browse the repository at this point in the history

4. ssh signing: retrieve a default key from ssh-agent …

   If user.signingkey is not set and a ssh signature is requested we call
   gpg.ssh.defaultKeyCommand (typically "ssh-add -L") and use the first key we get
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   fd9e226 View commit details

   Browse the repository at this point in the history

5. ssh signing: provide a textual signing_key_id …

   For ssh the user.signingkey can be a filename/path or even a literal ssh pubkey.
   In push certs and textual output we prefer the ssh fingerprint instead.
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   4838f62 View commit details

   Browse the repository at this point in the history

6. ssh signing: verify signatures using ssh-keygen …

   To verify a ssh signature we first call ssh-keygen -Y find-principal to
   look up the signing principal by their public key from the
   allowedSignersFile. If the key is found then we do a verify. Otherwise
   we only validate the signature but can not verify the signers identity.
   
   Verification uses the gpg.ssh.allowedSignersFile (see ssh-keygen(1) "ALLOWED
   SIGNERS") which contains valid public keys and a principal (usually
   user@domain). Depending on the environment this file can be managed by
   the individual developer or for example generated by the central
   repository server from known ssh keys with push access. This file is usually
   stored outside the repository, but if the repository only allows signed
   commits/pushes, the user might choose to store it in the repository.
   
   To revoke a key put the public key without the principal prefix into
   gpg.ssh.revocationKeyring or generate a KRL (see ssh-keygen(1)
   "KEY REVOCATION LISTS"). The same considerations about who to trust for
   verification as with the allowedSignersFile apply.
   
   Using SSH CA Keys with these files is also possible. Add
   "cert-authority" as key option between the principal and the key to mark
   it as a CA and all keys signed by it as valid for this CA.
   See "CERTIFICATES" in ssh-keygen(1).
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   facca53 View commit details

   Browse the repository at this point in the history

7. ssh signing: duplicate t7510 tests for commits …

   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   3326a78 View commit details

   Browse the repository at this point in the history

8. ssh signing: tests for logs, tags & push certs …

   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   f265f2d View commit details

   Browse the repository at this point in the history

9. ssh signing: test that gpg fails for unknown keys …

   Test that verify-commit/tag will fail when a gpg key is completely
   unknown. To do this we have to generate a key, use it for a signature
   and delete it from our keyring aferwards completely.
   
   Signed-off-by: Fabian Stelzer <fs@gigacodes.de>
   Signed-off-by: Junio C Hamano <gitster@pobox.com>

   

   FStelzer authored and gitster committed Sep 10, 2021
   Copy the full SHA

   1bfb57f View commit details

   Browse the repository at this point in the history