forge
/
build
1
0
Fork 0
Code Issues 13 Pull Requests Releases Wiki Activity

Secure supply chain (PGP) #9

New Issue
Open
opened 2020-09-22 22:09:23 +00:00 by southerntofu · 1 comment
southerntofu commented 2020-09-22 22:09:23 +00:00
Owner
Copy Link

Currently, forgebuild does very little for security (support for https sources). We should support PGP signatures for repositories.

However, git's verification of signatures (no idea about mercurial) only verifies the signature of HEAD, not of every commit. This is good basic security for most needs.

For more sensitive systems, we should find inspiration in guix's channel introductions to ensure the whole commit history has been vetted.

Currently, forgebuild does very little for security (support for https sources). We should support PGP signatures for repositories. However, git's verification of signatures (no idea about mercurial) only verifies the signature of HEAD, not of every commit. This is good basic security for most needs. For more sensitive systems, we should find inspiration in guix's [channel introductions](https://guix.gnu.org/en/blog/2020/securing-updates/) to ensure the whole commit history has been vetted.
southerntofu commented 2020-11-29 15:43:20 +00:00
Author
Owner
Copy Link

With GNU/Guix 1.2, their secure supply chain has been exposed as a subcommand: guix git authenticate.

It's a perfect fit for our usecase.

With [GNU/Guix 1.2](https://guix.gnu.org/en/blog/2020/gnu-guix-1.2.0-released/), their secure supply chain has been exposed as a subcommand: [guix git authenticate](https://guix.gnu.org/manual/en/html_node/Invoking-guix-git-authenticate.html). It's a perfect fit for our usecase.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
master
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: forge/build#9
No description provided.
Delete Branch "%!s(<nil>)"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?