53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
# 2. Sign Commits With GPG
|
|
|
|
| Date | Tags |
|
|
|------------|-------------------|
|
|
| 2018-02-16 | process, security |
|
|
|
|
|
|
## Status
|
|
|
|
Proposed
|
|
|
|
## Context
|
|
|
|
OpenBounty is a system which has value flowing through it.
|
|
Naturally security is a concern that should be taken into consideration.
|
|
|
|
Currently an attacker might get access to an account of a team member
|
|
and pose as that developer, merging PRs and pushing changes.
|
|
|
|
Status.im as a company is also encouraging the use of GPG signing and
|
|
has a Pull Request check in place on Github. This check will mark PRs
|
|
as failing if the commits come from an organization member and have not
|
|
been GPG-signed.
|
|
|
|
## Decision
|
|
|
|
In order to verify that commits in the repository are actually authored by the specified
|
|
author we adopt [GPG signing of Git commits](https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work).
|
|
|
|
This will allow us to verify authenticity of the author information saved in
|
|
a Git commit and make workflows like deploying on push safer.
|
|
|
|
It also introduces some complexity because contributors who want to sign
|
|
their commits need to set up the appropriate tooling. Due to that we will
|
|
not require outside contributors to sign their commits for now.
|
|
|
|
Adopting GPG signing for contributors will also make our PR checks pass
|
|
allowing us to more easily discern actually broken and working PRs.
|
|
|
|
## Consequences
|
|
|
|
GPG signing is only making things safer if we have a trusted way of
|
|
exchanging public keys. In the scenario outlined above a user who got access
|
|
to GitHub could simply upload an additional key.
|
|
|
|
This is currently a work-in-progress within the wider Status organization
|
|
and we'll have to wait to see what comes out of that.
|
|
|
|
## Appendix
|
|
|
|
- [GitHub's instructions for setting up GPG signing](https://help.github.com/articles/signing-commits-using-gpg/)
|
|
- More discussion around the usefulness of GPG signing in [issue #285](https://github.com/status-im/open-bounty/issues/285)
|