Signed Commit - Revision history

Olibouban: /* Basic Setup (GPG) */

2026-03-26T19:55:21Z

Basic Setup (GPG)

← Older revision		Revision as of 19:55, 26 March 2026
Line 23:		Line 23:
	Supply chain security — preventing compromised or spoofed commits from introducing malicious code		Supply chain security — preventing compromised or spoofed commits from introducing malicious code

	==~~Basic Setup~~ (GPG)==		==Quick Reference (GPG)==

	<pre>		<pre>

Olibouban: /* Quick Check */

2026-03-26T19:54:50Z

Quick Check

← Older revision		Revision as of 19:54, 26 March 2026
Line 98:		Line 98:
	== Quick Check ==		== Quick Check ==
	For a project using this Data Source, go to the workspace, add or edit a file and use the '''-S''' option to commit the change.		For a project using this Data Source, go to the workspace, add or edit a file and use the '''-S''' option to commit the change.


	* You should see the right badge (green Verified) in the Git platform (GitHub) for that commit.		* You should see the right badge (green Verified) in the Git platform (GitHub) for that commit.
	* git log should show the signed nature of the commit.		* git log should show the signed nature of the commit.

Olibouban: /* Create GPG keys and associate it with GitHub */

2026-03-26T19:53:34Z

Create GPG keys and associate it with GitHub

← Older revision		Revision as of 19:53, 26 March 2026
Line 81:		Line 81:
	* https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key		* https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
	* https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account		* https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account

			Quick reference:
			* '''gpg --full-generate-key''': To generate a new PGP (no passphrase)
			* '''gpg --list-keys --keyid-format=long''': List the keys, see the second line under pub in particular (41888..E48 below)
			* '''gpg --armor --export 418888888F85CAE48''': To get the public part of the key to push to GitHub for instance.


			== Sign All Commits? ==

			To sign all commits:

			$ git config --global commit.gpgsign true ([OPTIONAL] every commit will now be signed)
			$ git config --global user.signingkey 41888..E48(Note the key is taken from the highlighted output above and will be unique for each configuration)
			$ git config --global alias.logs "log --show-signature"

			== Quick Check ==
			For a project using this Data Source, go to the workspace, add or edit a file and use the '''-S''' option to commit the change.


			* You should see the right badge (green Verified) in the Git platform (GitHub) for that commit.
			* git log should show the signed nature of the commit.

Olibouban: /* Create GPG keys and associate it with GitHub */

2026-03-26T19:44:10Z

Create GPG keys and associate it with GitHub

← Older revision		Revision as of 19:44, 26 March 2026
Line 80:		Line 80:
	For example, for GitHub:		For example, for GitHub:
	* https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key		* https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
			* https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account

Olibouban: /* Git Data Sources */

2026-03-26T19:43:42Z

Git Data Sources

← Older revision		Revision as of 19:43, 26 March 2026
Line 74:		Line 74:
	John Doe		John Doe
	jdoe@acme.com		jdoe@acme.com


	== Create GPG keys and associate it with GitHub ==		== Create GPG keys and associate it with GitHub ==

Olibouban: /* Key Concepts Summary */

2026-03-26T19:43:16Z

Key Concepts Summary

← Older revision		Revision as of 19:43, 26 March 2026
Line 43:		Line 43:

	==Key Concepts Summary==		==Key Concepts Summary==
	~~TermMeaningGPG~~/PGP ~~keyThe~~ most common key format used for ~~signingVerified badgePlatform~~ confirmation that the signature checks ~~outVigilant modeA~~ GitHub setting that marks all unsigned commits as ~~unverifiedKeyserverA~~ public directory where you can publish your public key
	~~Signed commits are a foundational practice in modern software supply chain security, and are increasingly expected in professional and open source workflows.~~		{\| class="wikitable"
			\|+ Key Concepts
			! Term !! Meaning
			\|-
			\| '''GPG/PGP key''' \|\| The most common key format used for signing commits
			\|-
			\| '''Verified badge''' \|\| Platform confirmation that the signature checks out
			\|-
			\| '''Vigilant mode''' \|\| A GitHub setting that marks ''all'' unsigned commits as unverified
			\|-
			\| '''Keyserver''' \|\| A public directory where you can publish your public key
			\|}

	= Lingoport Localyzer =		= Lingoport Localyzer =

Olibouban: /* gpg and git */

2026-03-26T19:42:02Z

gpg and git

← Older revision		Revision as of 19:42, 26 March 2026
Line 54:		Line 54:
	tomcatuser@42216e9ba140:~$ gpg --version		tomcatuser@42216e9ba140:~$ gpg --version
	gpg (GnuPG) 2.2.27		gpg (GnuPG) 2.2.27

			== Git Data Sources ==
			Data Sources are associated with a Git account, with a username and an email. For signed commits, this account must be verified. For instance, if the email is not verified, signed commits cannot be verified.

			For signed commits, a Localyzer project must have a GPG configuration using that Git Data Source username and email.

			git config --get user.name && git config --get user.email
			John Doe
			jdoe@acme.com


			== Create GPG keys and associate it with GitHub ==
			From the container, create the GPG using the Data Source username and email as indicated. ''Do not use passphrase'' (empty), as this would be required as an input when running git commands from Localyzer.

			For example, for GitHub:
			* https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key

Olibouban: /* Lingoport Localyzer = */

2026-03-26T19:32:55Z

Lingoport Localyzer =

@@ Line 16: / Line 16: @@
 Repositories can also enforce a branch protection rule requiring all commits to be signed before they can be merged, ensuring a full chain of verified authorship on critical branches.
 Common Use Cases
@@ Line 55: / Line 45: @@
 TermMeaningGPG/PGP keyThe most common key format used for signingVerified badgePlatform confirmation that the signature checks outVigilant modeA GitHub setting that marks all unsigned commits as unverifiedKeyserverA public directory where you can publish your public key
 Signed commits are a foundational practice in modern software supply chain security, and are increasingly expected in professional and open source workflows.

Olibouban at 19:31, 26 March 2026

2026-03-26T19:31:58Z

@@ Line 16: / Line 16: @@
 Repositories can also enforce a branch protection rule requiring all commits to be signed before they can be merged, ensuring a full chain of verified authorship on critical branches.
 Common Use Cases
 Open source projects that accept contributions from strangers and need to trust the commit history

Olibouban: /* The Problem They Solve */

2026-03-26T19:29:56Z

The Problem They Solve

← Older revision		Revision as of 19:29, 26 March 2026
Line 3:		Line 3:

	==The Problem They Solve==		==The Problem They Solve==
	Git allows anyone to set any name and email address in their local configuration. Without signing, nothing stops a bad actor from impersonating another developer by simply setting user.name and user.email to someone else's values. Signed commits close this gap.		Git allows anyone to set any name and email address in their local configuration. Without signing, nothing stops a bad actor from impersonating another developer by simply setting ''user.name'' and ''user.email'' to someone else's values. Signed commits close this gap.

	==How They Work==		==How They Work==
	A contributor generates a cryptographic key pair — most commonly using GPG (GNU Privacy Guard), though SSH keys and S/MIME certificates are also supported. The private key stays secret on the contributor's machine; the public key is uploaded to their account on platforms like GitHub or GitLab.		A contributor generates a cryptographic key pair — most commonly using GPG (GNU Privacy Guard), though SSH keys and S/MIME certificates are also supported. The private key stays secret on the contributor's machine; the public key is uploaded to their account on platforms like GitHub or GitLab.