Simply put, I am wondering why would one need to sign one's commits with a GPG key when contributing to GitHub when one's already required to provide an SSH public key?
asked Apr 16, 2016 at 22:36
-
3Have a look at: programmers.stackexchange.com/questions/212192/… Not sure which SSH key you refer to.– ArminiusApr 17, 2016 at 4:21
-
@Arminius That help.github.com/articles/generating-an-ssh-key– Mahmoud TantawyApr 17, 2016 at 7:46
Add a comment
|
1 Answer
When you authenticate to Github with your SSH key, that authentication doesn't become part of the repository in any meaningful or lasting way. It causes Github to give you access for the moment, but it doesn't prove anything to anyone who is not Github.
When you GPG-sign a git tag, that tag is part of the repository, and can be pushed to other copies of the repository. Thus, other people who clone your repository can verify the signed tag, assuming that they have access to your public key and reason to trust it.
While it isn't necessary to tag and GPG-sign every single commit, it is wise to provide GPG-signed tags at least on each commit that corresponds to a released version of your code. You may wish to do more than that, but that is the bare minimum of responsible behavior, as it provides reasonable assurance that:
The commit in question really does correspond to the release in question.
The commit in question (and to the degree that we trust the SHA1 hashes used in git commit history, all of its predecessors) came from the signer (and, if applicable, the signer's team).
The commit in question wasn't tampered with after the signer tagged it.
Note that I said "reasonable assurance", not "perfect certainty"...there are other things that can go wrong with software integrity. However, providing signed tags at least for official releases is a huge step in the right direction.
-
15Why can't the SSH key be used to sign commits? Aren't both private keys after all?– GiliNov 25, 2016 at 5:13
-
1technically, yes. But reformatting of keys is required. Out of the box, ssh and pgp keys weren't intended to be reused, but it's possible: security.stackexchange.com/q/32768/28652 Dec 9, 2016 at 20:36
-
Can't I use the gpg key to do ssh tasks like cloning for example or do I still have to add my ssh-rsa?– YvesJun 2, 2017 at 13:28
-
I thought it would be nice to just use the gpg key stored on keybase for such tasks as well. By that I also could easily share mit public key to get added to other repos for example.– YvesJun 2, 2017 at 13:30
-
12I wonder if this topic is elaborated somewhere? I would like to read more about this. Nov 5, 2018 at 14:05