1.9 KiB
2. Sign Commits With GPG
| Date | Tags |
|---|---|
| 2018-02-16 | process, security |
Status
Proposed
Context
OpenBounty is a system which has value flowing through it. Naturally security is a concern that should be taken into consideration.
Currently an attacker might get access to an account of a team member and pose as that developer, merging PRs and pushing changes.
Status.im as a company is also encouraging the use of GPG signing and has a Pull Request check in place on Github. This check will mark PRs as failing if the commits come from an organization member and have not been GPG-signed.
Decision
In order to verify that commits in the repository are actually authored by the specified author we adopt GPG signing of Git commits.
This will allow us to verify authenticity of the author information saved in a Git commit and make workflows like deploying on push safer.
It also introduces some complexity because contributors who want to sign their commits need to set up the appropriate tooling. Due to that we will not require outside contributors to sign their commits for now.
Adopting GPG signing for contributors will also make our PR checks pass allowing us to more easily discern actually broken and working PRs.
Consequences
GPG signing is only making things safer if we have a trusted way of exchanging public keys. In the scenario outlined above a user who got access to GitHub could simply upload an additional key.
This is currently a work-in-progress within the wider Status organization and we'll have to wait to see what comes out of that.
Appendix
- GitHub's instructions for setting up GPG signing
- More discussion around the usefulness of GPG signing in issue #285