Harness the power of signify(1) to sign arbitrary git objects

Tiago Carvalho

Last update: Jul 27, 2023

Related tags

Cryptography git rust security cryptography openbsd signature signify

Overview

git-signify

A tool to sign arbitrary objects in a git repository.

Generating keys

Signing keys can be generated with signify, from the OpenBSD project.

$ signify -G -p newkey.pub -s newkey.sec

If you do not wish to encrypt your keys, pass the -n flag to the command line of signify.

Basic usage

This program keeps track of signatures made by a keypair with a given fingerprint as git references. References can be fetched from and pushed to a remote.

$ git signify pull origin
$ git signify push origin

Verification can be done with git signify verify. For example, to verify a release of git-signify itself:

$ git pull --tags
$ git signify pull
$ git signify verify -k <(curl -sfL https://gandas.us.to/keys/git.pub) v0.3.0

To sign git revisions, run something akin to:

$ git signify sign -k <secret-key> v0.3.0

In-depth

Brief overview of how this program works

git-signify writes a tree object to some git repository containing the following blobs:

100644 blob aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa	object
100644 blob bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb	signature

Where object stores the raw (20 byte) object id of some git object to be signed, and signature stores the signature over object. The tree's hash is returned by git signify raw sign.

Storing signatures in tags

To store signatures in tags, one must use the "raw" mode of git-signify. The raw flags supported by this program and their respective documentation can be checked by running the following commands:

$ git signify raw -h
$ git signify raw sign -h
$ git signify raw verify -h

The suggested approach to store signatures in tags is the following:

$ SIGNATURE_TREE=$(git signify raw sign -k $SECRET_KEY $OBJECT_TO_SIGN)
$ SIGNATURE_COMMIT=$(git commit-tree $SIGNATURE_TREE -m Signature)
$ git tag signature-$OBJECT_TO_SIGN $SIGNATURE_COMMIT
$ git push --tags

Verification can then be done with:

$ git signify raw verify -p -k $PUBLIC_KEY $SIGNATURE_COMMIT^{tree}

a test harness for embedded devices

defmt-test a test harness for embedded devices This crate has been moved to the defmt repository Support defmt-test is part of the Knurling project, F

8 Aug 27, 2022

Decode, explore, and sign JWTs

JWT Explorer A utility for inspecting, modifying, and attacking JWTs. Supports Windows and Linux and probably also works on macOS but this has not bee

9 Nov 9, 2022

OpenID Connect Single Sign-On Identity Provider

Rauthy CAUTION: There has not been any third party security audit for this project. Use this software at your own risk! INFO: This project is currentl

2 Jul 29, 2023

xyz is a chat platform where people sign up, play a matching game, and say goodbye

xyz is an asynchronous chat and web service What you need Docker Desktop 🐳 Cargo (Rust package manager) 📦 Clone our project Follow the steps below t

12 Oct 11, 2023

A Rust CLI tool that helps you enforce Git policies through Git hooks both server and client side

GitPolicyEnforcer This is a command line utility written in Rust, that helps you utilize Git hooks, to enforce various policies. It currently supports

4 Aug 14, 2022

git-cliff can generate changelog files from the Git history by utilizing conventional commits as well as regex-powered custom parsers.⛰️

git-cliff can generate changelog files from the Git history by utilizing conventional commits as well as regex-powered custom parsers. The changelog template can be customized with a configuration file to match the desired format.

5k Jan 9, 2023

First Git on Rust is reimplementation with rust in order to learn about rust, c and git.

First Git on Rust First Git on Rust is reimplementation with rust in order to learn about rust, c and git. Reference project This project refer to the

1 Jan 28, 2022

A git sub-command to view your git repository in the web browser

git-view A git sub-command to view your git repository in the web browser! About Are you also frustrated from moving your hands away from the keyboard

5 Sep 26, 2022

Git Explorer: cross-platform git workflow improvement tool inspired by Magit

Gex Git workflow improvement CLI tool inspired by Magit. This project is still under initial development, but I am actively dogfooding it and features

204 Jan 6, 2023

Simulation tools for animating interacting soft objects

Softy Simulation tools and libraries for animating rigid and soft objects (including cloth) subject to frictional contacts against smooth implicit sur

23 Jul 7, 2022

A stack-allocated box that stores trait objects.

This crate allows saving DST objects in the provided buffer. It allows users to create global dynamic objects on a no_std environment without a global allocator.

19 Dec 13, 2022

Vue, React, Solid, Angular, Svelte, and Liquid From JS Objects.

11 Sep 21, 2022

Vue, React, Solid, Angular, Svelte, and Liquid From JS Objects.

18 Jul 17, 2021

Remoc 🦑 — Remote multiplexed objects and channels for Rust

Remoc 🦑 — remote multiplexed objects and channels Remoc makes remote interaction between Rust programs seamless and smooth. Over a single underlying

98 Dec 21, 2022

beaver is a library for setting up Rust objects inspired by factory_bot.

beaver is a library for setting up Rust objects inspired by factory_bot. Usage | Examples | Docs Dependencies [dependenci

40 Sep 6, 2022

Parser for Object files define the geometry and other properties for objects in Wavefront's Advanced Visualizer.

format of the Rust library load locad blender obj file to Rust NDArray. cargo run test\t10k-images.idx3-ubyte A png file will be generated for the fi

1 Jan 3, 2022

A stack for rust trait objects that minimizes allocations

dynstack A stack for trait objects that minimizes allocations COMPATIBILITY NOTE: dynstack relies on an underspecified fat pointer representation. Tho

114 Nov 28, 2022

The goal of this challenge is to create an isometric, decorated scene in which the character can move around the objects in the room.

0 Feb 4, 2022

The Rank-Biased Centroids (RBC) rank fusion method to combine multiple-rankings of objects.

Rank-Biased Centroids (RBC) The Rank-Biased Centroids (RBC) rank fusion method to combine multiple-rankings of objects. This code implements the RBC r

2 Sep 8, 2022

Comments

Replace top-level sign and verify commands
Related to #1 and #2

The top-level sign and verify commands should be replaced with higher level commands that store signature trees in git references, and read from these references, respectively.

Example:

# writes to .git/refs/signify/signatures/<key-fingerprint>/<git-revision> $ git signify sign -k <key> <git-revision> # reads from .git/refs/signify/signatures/<key-fingerprint>/<git-revision> $ git signify verify -k <key> <git-revision>
enhancement
opened by sug0 0
Move `sign` and `verify` to low level commands section
The primitives sign and verify should seldom be used directly. We should move them to a sub-command like:

$ git signify primitive sign ... $ git signify primitive verify ...
enhancement
opened by sug0 0
Store signatures in git references
References to signatures can be stored in a namespace identical to:

.git/refs/signify/signatures/<fingerprint>/<signed-object-id>

Where <fingerprint> is the result of running git hash-object on the raw public key bytes of a user identity (i.e. keypair), and <signed-object-id> corresponds to the id of a signed object. The content of the reference can be the output of signing an object with git signify.
enhancement
opened by sug0 0

Harness the power of signify(1) to sign arbitrary git objects

Related tags

Overview

git-signify

Generating keys

Basic usage

In-depth

Brief overview of how this program works

Storing signatures in tags

You might also like...

a test harness for embedded devices

Decode, explore, and sign JWTs

OpenID Connect Single Sign-On Identity Provider

xyz is a chat platform where people sign up, play a matching game, and say goodbye

A Rust CLI tool that helps you enforce Git policies through Git hooks both server and client side

git-cliff can generate changelog files from the Git history by utilizing conventional commits as well as regex-powered custom parsers.⛰️

First Git on Rust is reimplementation with rust in order to learn about rust, c and git.

A git sub-command to view your git repository in the web browser

Git Explorer: cross-platform git workflow improvement tool inspired by Magit

Simulation tools for animating interacting soft objects

A stack-allocated box that stores trait objects.

Vue, React, Solid, Angular, Svelte, and Liquid From JS Objects.

Vue, React, Solid, Angular, Svelte, and Liquid From JS Objects.

Remoc 🦑 — Remote multiplexed objects and channels for Rust

beaver is a library for setting up Rust objects inspired by factory_bot.

Parser for Object files define the geometry and other properties for objects in Wavefront's Advanced Visualizer.

A stack for rust trait objects that minimizes allocations

The goal of this challenge is to create an isometric, decorated scene in which the character can move around the objects in the room.

The Rank-Biased Centroids (RBC) rank fusion method to combine multiple-rankings of objects.

Comments

Replace top-level sign and verify commands

Move `sign` and `verify` to low level commands section

Store signatures in git references

Owner

Tiago Carvalho

Crypto in, power out

The free password manager for power users

🍹Branch and bound solution using Rust to calculate an optimal cocktail ingredient list of arbitrary length 🍸

🤖CyberAI is designed to bridge the world of Cyberpunk 2077 and the power of OpenAI's AI technology.

🔗 Tool for rebasing a chain of local git branches.

VSDB is a 'Git' in the form of a KV database.

Authenticate a tarball through a signed tag in a git repository (with reproducible builds)

🗂️ A simple, opinionated, tool, written in Rust, for declaratively managing Git repos on your machine.

Git FIDO Helper - Sign your Git commits with multiple resident SSH keys

Experimental one-shot benchmarking/profiling harness for Rust