Skip to content

03-sign-verify-merges.md

Latest commit

 

History

History
206 lines (145 loc) · 6.63 KB

03-sign-verify-merges.md

File metadata and controls

206 lines (145 loc) · 6.63 KB
Raw

🎒 Exercise: Signing and verifying merges

Signing and verifying commits Signing and verifying merges • Signing and verifying tags

Signing merges from one branch into another is achieved via the --verify-signatures flag to git merge, which is important to understand how it works:

Verify that the tip commit of the side branch being merged is signed with a valid key, i.e. a key that has a valid uid: in the default trust model, this means the signing key has been signed by a trusted key. If the tip commit of the side branch is not signed with a valid key, the merge is aborted.

In examining the underlying code1, this appears to work by checking the latest commits of the branches involved in the merge, not every commit:

	/*
	 * All the rest are the commits being merged; prepare
	 * the standard merge summary message to be appended
	 * to the given message.
	 */
	remoteheads = collect_parents(head_commit, &head_subsumed,
				      argc, argv, &merge_msg);

	if (!head_commit || !argc)
		usage_with_options(builtin_merge_usage,
			builtin_merge_options);

	if (verify_signatures) {
		for (p = remoteheads; p; p = p->next) {
			verify_merge_signature(p->item, verbosity,
					       check_trust_level);
		}
	}

Outcomes

In this exercise, the process for signing and verifying merges is covered including:

  1. Explicitly sign and verify commits
  2. Troubleshooting problems
  3. Optional Git configurations to sign and verify all commits

Steps

Note This exercise uses preparation done previously in "Signing and verifying commits".

  1. Create a branch where changes will be committed towards v1.0.0 release

    git checkout -b feature/v1.0.0

  2. Create a simple "Hello world!" shell script

    cat << 'EOF' > hello-world.sh
#! /usr/bin/env bash

echo "Hello world!"
EOF

chmod 755 hello-world.sh
./hello-world.sh

    resulting in:

    Hello world!

  3. Commit "Hello world!" shell script to feature branch

    git add .
git commit -m "Adding hello-world script for v1.0.0 release"
    Git tree after commiting hello-world script on feature/v1.0.0 branch

  4. Checkout the default branch to prepare for merging the feature branch

    git checkout main

  5. Update the README prior to merging our changes for the new script

    cat << 'EOF' >> README.md

## Hello world!

The `v1.0.0` release contains the `hello-world.sh` script, which understandably displays `Hello world!`.
EOF

  6. Commit updated README changes prior to merging our changes

    git add .
git commit -m "Expanding README for upcoming feature"
    Git tree after updating README before merge

  7. Merge the feature branch, ensuring signatures are verified

    git merge --verify-signatures feature/v1.0.0 -m "Merging in work towards v1.0.0 release"
    Git tree after merging feature/v1.0.0 branch

    Possible results:

    • Commit 666e636 has a good GPG signature by andyfeller@github.com
Merge made by the 'ort' strategy.
 hello-world.sh | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100755 hello-world.sh

      🥳 Congratulations! SSH merge signing is good.

    • fatal: Commit 666e636 does not have a GPG signature.

      😥 Do not to worry! This is error is likely due to the last commit not being signed or not trusted signer.

    For more information about signing merges, see "git merge --verify-signatures".

  8. Confirm logs show SSH commit sign status

    git log

    Possible results:

    • commit 28c46b890121f042e86d7d1c1b58e150b8ac9948 (HEAD -> main)
Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
Merge: ba5a622 666e636
Author: Andy Feller <andyfeller@github.com>
Date:   Sat Sep 10 19:55:34 2022 -0400

    Merging in work towards v1.0.0 release

commit ba5a622501be61cc531c0732fd005c2dccb34944
Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
Author: Andy Feller <andyfeller@github.com>
Date:   Sat Sep 10 19:55:26 2022 -0400

    Expanding README for upcoming feature

commit 666e6364fc8e3156e31de42b103dca58a0ff7a62 (feature/v1.0.0)
Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
Author: Andy Feller <andyfeller@github.com>
Date:   Sat Sep 10 19:53:01 2022 -0400

    Adding hello-world script for v1.0.0 release

commit 14512033ae98ddb55eaebeedb27fdb78ae6cac49
Good "git" signature for andyfeller@github.com with ED25519 key SHA256:kanlHE9MI77O18EdnFxgEnzc3v1rxJHlW475IbnHdG8
Author: Andy Feller <andyfeller@github.com>
Date:   Sat Sep 10 19:49:07 2022 -0400

    Initialize workspace repository README

      🥳 Congratulations! SSH merge verification setup is good.

  9. Configure additional SSH merge signing and verifying for workshop repository specifically:

    git config merge.verifySignatures true

    Note To globally configure SSH signing and verifying, use the --global flag:

    git config --global merge.verifySignatures true

    For more information about these Git configuration options, see merge.verifySignatures.

End of exercise

At the end of this exercise, the repository should look like:

Git tree at the end of the exercise

Next: Signing and verifying tags

Footnotes

  1. https://github.com/git/git/blob/dd3f6c4cae7e3b15ce984dce8593ff7569650e24/builtin/merge.c#L1491 ↩