[Mirror] SSH public keys including those for verifying my commits
Go to file
Aminda Suomalainen ⚧ 3abf9705d8
README.md: make the waybackmachine link more obvious
2022-01-09 21:13:26 +02:00
aminda aminda: add mobile key just in case 2022-01-09 20:10:54 +02:00
README.md README.md: make the waybackmachine link more obvious 2022-01-09 21:13:26 +02:00
allowed_signers aminda: add mobile key just in case 2022-01-09 20:10:54 +02:00

README.md

allowed_signers file for SSH/git

Git 2.34 brings support for signing commits with SSH key and having a SSH-compatible smartcard, I have to try this. It likely getting more common in the future doesn't hurt either and I have pgp-alt-wot which does about the same for PGP.

Where to find keys

  • GitHub, Giteas and GitLabs expose user public keys when you append a .keys after their profile page
  • Good ideas are made to be copied, so maybe there will be more repositories like this ;)

Quick howto

I don't mean this to be used directly, only to be took inspiration from. See the first link in further reading.

mkdir -p ~/src/gitea.blesmrt.net/Mikaela
cd ~/src/gitea.blesmrt.net/Mikaela
git clone https://gitea.blesmrt.net/Mikaela/ssh-allowed_signers.git
git config --global gpg.ssh.allowedSignersFile ~/src/gitea.blesmrt.net/Mikaela/ssh-allowed_signers/allowed_signers

Git commands should now recognised commits signed with keys I have allowed. In the last command it's fine to remove --global to only affect the single repository you are on (while I haven't tested this), should that repository be something only I am signing in or something I need to verify otherwise enough to list it here.

On the last command, git config turns it into absolute path, while manually edited .gitconfig can literally have the above. I wonder if the command would understand -- before the file, but not enough to actually try it 😃

Further reading