Securing Git Repositories with Gittuf
summary
Gittuf embeds signed policy metadata inside Git refs so repositories carry verifiable rules and a reference state log that records every ref update, signed and auditable. It supports key types (GPG SSH Sigstore Gitsign), delegates trust, and demonstrates enforcement: a demo enforces a two-signature rule, rejects a single-sign push, and rolls back the invalid update, with a GitHub Action verifying compliance. Project lives in the OpenSSF sandbox and integrates in-toto attestations for CI provenance and automated key rotation.
AI-written summary · about
chapters (13)
- 0:00Securing Git repositories
- 1:02Software supply chain security
- 2:51Source code protection policies
- 4:35Git’s security limits
- 7:42Desired Git security properties
- 10:29Introducing GitTuf
- 11:12GitTuf and TUF project
- 12:15Reference state log
- 15:27GitTuf policy demo
- 18:37Policy violations and rollbacks
- 25:43Future plans and UX
- 27:50Getting involved with GitTuf
- 28:34Q&A
related talks
27mThinking About Source Code Security in New Ways
24mThe State of Git Security With SLSA and Gittuf
29mIdentity-based Source Integrity with Gitsign
34mSafe and Signed Git Commits with PGP
37mGitsign – Keyless Git Commit Signing
10mSource Attestations with Gitsign
30mPractical (and impractical) git commit signing
34mWhen the Going Gets Tough, Get TUF Going! [I]