Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP

Committer Keys

Tod Beardsley edited this page · 55 revisions

Metasploit Wiki Pages


Clone this wiki locally

This page lists the keys in use by Metasploit committers and can be used to verify merge commits made to https://github.com/rapid7/metasploit-framework.

Keybase.io identities

Keybase.io is currently in public beta, but we'll go ahead and treat it as production ready, since it seems like an easy way to verify identities.

If you're a committer on metasploit-framework, and you need an invite, just ask.

Github Username Keybase.io Username
@bcook-r7 busterb
@FireFart firefart
@hmoore-r7 hdm
@jlee-r7 egypt
@jhart-r7 jhart
@joevennix joevennix
@jvazquez-r7 jvazquezr7
@kernelsmith kernelsmith
@limhoff-r7 kronicdeth
@mbuck-r7 techpeace
@Meatballs1 meatballs
@OJ oj
@scriptjunkie scriptjunkie
@timwr timwr
@todb-r7 todb
@wchen-r7 wchenr7
@wvu-r7 wvu
@zeroSteiner zerosteiner

Note, keybase.io does not require your private key to prove your GitHub identity. Actually sharing your private key with Keybase.io is a matter of contention -- here's the usual argument against, and here's one thoughtful argument for.

As all Metapsloit Framework committers are quite comfortable with the command line, there should be no need to store your (encrypted) private key with a third party. So, please don't, unless you have amazingly good reasons (and a great local password).

Tracking criteria

In order to get @todb-r7 to track your key, you alert him to its existence through some non-GitHub means, and verify your GitHub username. That's all there is to it.

It would be sociable to track him (and everyone else on this list) back. Tracking is essentially "trusting" and "verifying" -- see the much longer discussion here.

Signing HOWTO

Signing merges and commits is easy and fun. Generate a signing key, if you don't have one already, using your favorite PGP/GPG interface (I use gpg --gen-key). Then add this to your $HOME/.gitconfig:

[user]
  name = Your Name
  email = your_email@example.com
  signingkey = DEADBEEF # Must match name and email exactly!
[alias]
  c = commit -S --edit
  m = merge -S --no-ff --edit

Using git c and git m from now on will sign every commit with your DEADBEEF key. However, note that rebasing or cherry-picking commits will change the commit hash, and therefore, unsign the commit -- to resign the most recent, use git c --amend.

Something went wrong with that request. Please try again.