Navigating the Land of Git Commit Signatures With Gittuf - Patrick Zielinski & Yongjae Chung

Navigating the Land of Git Commit Signatures With Gittuf - Patrick Zielinski, Secure Systems Lab @ NYU & Yongjae Chung, New York University You’ve probably heard by now that Git supports signing your commits and the chorus encouraging you to sign your commits. There’s just a tiny little problem: what exactly do you do with those signatures? How do you know if a signature is legitimate? When a signing key needs to be rotated and is marked as untrusted, does that mean your entire Git history is “untrusted”? What makes a commit “Verified” on GitHub? Wonder no more. In this talk, we will discuss the state of Git commit signing today, and dispel the mysteries that surround making sense of commit signatures. We’ll look at how gittuf brings structure to commit signatures, and then uses these signatures to enforce a security policy on your repository.