Show verification badge for commits signed by a certificate
What does this MR do and why?
With SSH certificates initiative we've added the ability to authenticate using SSH certificates. However, it's also possible to sign commits using the certificates.
This MR adds the ability to recognize the signed commits and show a badge according to the verification status.
When a certificate is passed via -f
option to ssh-keygen
utility:
ssh-keygen -Y sign -f id_ed25519-cert.pub -n git message.txt
It puts the certificate as a public key information into the signature. We can use that information to verify the signature and associate it with CA configured in a group.
Related issue: Sign commits using SSH certificates (#435648 - closed)
Steps
- Enable
enforce_ssh_certificates_via_settings
andssh_certificates_rest_endpoints
feature flags - Configure the user to be an Enterprise user or just disable this line in code
- Generate CA:
ssh-keygen -f CA -t ed25519
- Add
CA.pub
file to the a top-level group inrails c
:
Groups::SshCertificates::CreateService.new(<top-level-group>, { key: <content-of-CA.pub>, title: 'ED25519 key' }, User.first).execute
- Issue a certificate:
ssh-keygen -s CA -I admin@example.com -V +1d ~/.ssh/id_ed25519.pub
, whereadmin@example.com
is the email of your committer and~/.ssh/id_ed25519.pub
is the path to the public part of your signing SSH key - Configure Git to sign commits using your SSH certificate:
[user]
...
signingkey = /Users/.../.ssh/id_ed25519-cert.pub
[gpg]
format = ssh
[commit]
gpgsign = true
- Create a commit and push
-
Verified
label appears near your commit in GitLab (screenshot below)
Screenshots
Edited by Igor Drozdov