[Mirror] SSH public keys including those for verifying my commits
Go to file
Aminda Suomalainen 721e52b41f
allowed_signers: fix valid-after time for gpg
2024-10-23 13:36:14 +03:00
aminda add gpg authentication subkey 2024-10-23 13:26:55 +03:00
jae fix comment on Jae's key, mkdir, authorized_keys 2022-08-20 15:12:25 +03:00
joelkoen add @joelkoen for git logging beacondb etc. 2024-08-18 08:50:54 +03:00
leon Add Leon's key 2023-06-17 15:45:50 +03:00
mtrnord add mtrnord's key 2023-02-16 14:23:16 +02:00
.editorconfig .{gitattributes,editorconfig}: eol=lf 2023-05-09 13:28:23 +03:00
.gitattributes .{gitattributes,editorconfig}: eol=lf 2023-05-09 13:28:23 +03:00
.gitignore update dependencies 2024-08-10 12:38:36 +03:00
.mailmap add .mailmap 2024-08-24 22:27:17 +03:00
.npmrc update dependencies 2024-08-10 12:38:36 +03:00
.nvmrc update dependencies 2024-08-10 12:38:36 +03:00
.pre-commit-config.yaml update dependencies 2024-10-23 13:30:41 +03:00
.python-version update dependencies 2024-10-23 13:30:41 +03:00
README.md update README.md for codeberg 2024-08-10 12:39:30 +03:00
allowed_signers allowed_signers: fix valid-after time for gpg 2024-10-23 13:36:14 +03:00
package.json update dependencies 2024-10-23 13:30:41 +03:00
pnpm-lock.yaml update dependencies 2024-10-23 13:30:41 +03:00

README.md

allowed_signers file for SSH/git

Git 2.34 brings support for signing commits with SSH key and having a SSH-compatible smartcard, I have to try this. It likely getting more common in the future doesn't hurt either and I have pgp-alt-wot which does about the same for PGP.

Where to find keys

Quick howto

I don't mean this to be used directly, only to be took inspiration from. See the first link in further reading.

mkdir -p ~/src/codeberg.org/Aminda
cd ~/src/codeberg.org/Aminda
git clone https://codeberg.org/Aminda/ssh-allowed_signers.git
git config --global gpg.ssh.allowedSignersFile ~/src/codeberg.org/Aminda/ssh-allowed_signers/allowed_signers

Git commands, such as git verify-commit --raw HEAD or git log --show-signature, should now recognised commits signed with keys I have allowed. In the last command it's fine to remove --global to only affect the single repository you are on (while I haven't tested this), should that repository be something only I am signing in or something I need to verify otherwise enough to list it here.

On the last command, git config turns it into absolute path, while manually edited .gitconfig can literally have the above. I wonder if the command would understand -- before the file, but not enough to actually try it 😃

Mirrors

Further reading

Forge support