Git Security

Code Reviews, Two-person reviewed
Git Commit Signing
MFA on accounts, GitHub, Gitlab etc.

Reading Material

Git Commit Signing Exercise

Needed:

GPG Key
GitHub Account

Generating a GPG Key

Generate a key with gpg gpg --passphrase '' --gen-key
Select what key you want to use
Fill out your name and your email address. Make sure this matches the one in your GitHub account.
Add a comment if you want to remind you what the key is for.
You may be prompted for a passphrase to add to the key for extra security, for this example hit enter 3 times to not add a passphrase.

Here is what the prompts will look like.

Expand here is what it looks like in its entirety

± |main U:26 ?:9 ✗| → gpg --gen-key
gpg (GnuPG) 2.3.1; Copyright (C) 2021 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (9) ECC (sign and encrypt) *default*
  (10) ECC (sign only)
  (14) Existing key from card
Your selection? 9
Please select which elliptic curve you want:
   (1) Curve 25519 *default*
   (4) NIST P-384
   (6) Brainpool P-256
Your selection? 1
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GnuPG needs to construct a user ID to identify your key.

Real name: James Strong
Email address: strong.james.e@gmail.com
Comment: testing for workshop
You selected this USER-ID:
    "James Strong (testing for workshop) <strong.james.e@gmail.com>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 8246A1EC900B5E30 marked as ultimately trusted
gpg: directory '/Users/strongjz/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/Users/strongjz/.gnupg/openpgp-revocs.d/3E0424931246D33A86890BC78246A1EC900B5E30.rev'
public and secret key created and signed.

pub   ed25519 2021-08-17 [SC]
      3E0424931246D33A86890BC78246A1EC900B5E30
uid                      James Strong (testing for workshop) <strong.james.e@gmail.com>
sub   cv25519 2021-08-17 [E]

Add Key to GitHub Account

1. Export public key

Get the Key ID with gpg --list-secret-keys --keyid-format LONG $YOUR_EMAIL

Export the public key with gpg --armor --export $YOUR_LONG_KEY_ID

2. Add to GitHub

Open https://github.com/settings/keys

sign_add_key

Copy and Paste the Public Key into your GitHub account

sign_add_key

3. Add to git config

Get the key id for the one we just created.

$ gpg --list-secret-keys --keyid-format LONG $EMAIL

sec   ed25519/8246A1EC900B5E30 2021-08-17 [SC]
      3E0424931246D33A86890BC78246A1EC900B5E30
uid                 [ultimate] James Strong (testing for workshop) <strong.james.e@gmail.com>
ssb   cv25519/0BAFF11345FB8338 2021-08-17 [E]

Update git config to use the key.

$ git config --global user.signingkey 3E0424931246D33A86890BC78246A1EC900B5E30
$ git config --global commit.gpgsign true

4. Test a Commit.

Create a testing repo in GitHub.com, then add it locally

cd ~/environment/
mkdir signing-test
git init
  Initialized empty Git repository in /home/ec2-user/environment/signing-test/.git/
echo "signing-test" >> README.md

Then use those remotes to add to empty repo.

git remote add origin git@github.com:strongjz/git-signging-test.git
git branch -M main
git push -u origin main
git add -A
git commit -m "signing"
  [main b2a6fb5] signing
git push origin main

5. Verify in GitHub

In the commit history you can see a “Verified” tag on your commits now

sign_add_key

Make sure to store this GPG private key in a secure location

6. Store GPG key (optional)

To export the key use this.

Identify your private key: gpg --list-secret-keys $EMAIL

sec   ed25519 2021-08-17 [SC]
      3E0424931246D33A86890BC78246A1EC900B5E30
uid           [ultimate] James Strong (testing for workshop) <strong.james.e@gmail.com>
ssb   cv25519 2021-08-17 [E]

Run this command to export your key: gpg --export-secret-keys 3E0424931246D33A86890BC78246A1EC900B5E30 > private.key

If you have a passphrase on the key you’ll have to enter it to export it.

Copy the key file to another secure location.

To import on a new machine, run gpg --import private.key

Sources:

Using Keybase: https://github.com/pstadler/keybase-gpg-github

Plain GPG: https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/generating-a-new-gpg-key