Keynote: Signing Git Commits with Gitsign
summary
gitsign provides keyless Git commit signing by combining Sigstore auth with a Rekor transparency log so commits carry a signature plus a short‑lived x509 certificate (email embedded) instead of a user‑managed key. Installation is a one‑time repo config that makes Git call gitsign for each commit and triggers the familiar OAuth flow; signatures and certificates are uploaded to the Rekor transparency log and can be verified with git verify-commit or the web UI, and the demo shows it working end to end.
AI-written summary · about
related talks
37mGitsign – Keyless Git Commit Signing
29mIdentity-based Source Integrity with Gitsign
10mSource Attestations with Gitsign
30mPractical (and impractical) git commit signing
15mDemystifying Digital Signatures
34mSafe and Signed Git Commits with PGP
01h 27mSupply Chain Security Tooling
40mSigstore: How We Started, Where We Are, Where We are Headed