me when i find out i can use ssh to sign my git commits
me when i find out i can use ssh to sign my git commits
me when i find out i can use ssh to sign my git commits
The only real advantage to using SSH vs PGP keys is you don't need an external dependency (GPG). PGP is always going to be better, because you get the advantage of WOT, and PGP public key servers to verify identities over just "this is who I am, here's my key." You should always sign your commits, no matter what you use. Identity verification is very important in open source.
cli
$ git config --global gpg.format ssh $ git config --global user.signingkey ~/.ssh/examplekey.pub
Are you using your public ssh key for signing? Wouldn't it make more sense to use the private one as people can then verify your identity by using your public key?
Ha, good catch! Behind the scences, git is actually using your private key to sign the commit. You're only specifying the ssh key git should ask ssh-agent about. You can also specify the private key and actually need to when not using an agent and the key is not available. See docs
You seem to be fundamentally misunderstanding how the shared keys work, here. You don't get to choose which key you sign with, either private or public.
If you sign a statement, it uses your private key. Period. The methodology is only the original owner of the keys has access to the private key, so any signed statement also using that private key, is directly from the key owner. Alternatively, anyone has access to your private key, and can encrypt data using it, that only the owner, with access to the private key, can decrypt.
Anyone in the world can encrypt a message that only you can decrypt. That's the way it works. Alternatively, when you sign a statement, you're establishing that the owner of the key pair signed it, as only the owner has access to the private key. Then, anyone in the world can verify your signed statement using your public key.
You don't get to choose which one you use. In the example from my original post, the ssh-agent only needs reference to the location of one of the two keys, and will use the filename regardless, to distinguish between public and private. If I point the configuration option to this_is_my_key
indicating a private key, it will automatically use this_is_my_key.pub
as a public key. If I indicate this_is_my_key.pub
then it does the reverse and will assume that this_is_my_key
is the private key. It doesn't matter which one you specify, the ssh-agent just needs a filename to work with.
Public is used to encrypt, private is used to decrypt.
Wouldn't that mean you'd have to share your public key anyway?
I have the same repos in multiple vms, keeping tabs of that key would be... interesting, considering i often use passwordless-logins across the board.
Wouldn’t that mean you’d have to share your public key anyway?
Public keys aren't meant to be private. The function is literally in the name... But no, you don't necessarily have to share your public key, but for someone to verify that a specific public key was used to sign a commit, the public key is required. So there's absolutely no reason to sign your commits if you intend on keeping your public key, private... It completely defeats the entire purpose....
does anyone know how to configure SSH signing on a remote server without creating another key on that server?
If I'm using the same SSH key pair to access the remote server it kinda makes sense to use it to sign, but I don't know how I would go about configuring git to do it.
But I like gpg more :(
SSH makes life so much easier. Honestly a blessing not having to use gpg keys
Really. I switched over a year ago. They're much easier to manage.