This contribution introduces an "allowed signers" file that list the accepted pub keys of Tuleap integrators for SSH signatures. This is the counterpart of the existing repository [0] dealing with PGP/GPG keys. To verify the signatures, setup Git to the allowed signers file with `git config gpg.ssh.allowedSignersFile tools/utils/signing-keys/allowed-integrators`. This commit is signed so you can use it as an example with `git log --show-signature`. To sign a commit with SSH tell Git to use it with the `gpg.format` setting and select the appropriate key with the `user.signingKey` setting [1]. [0] https://tuleap.net/plugins/git/tuleap/tools/git-signature-verifier [1] https://git-scm.com/docs/git-config#Documentation/git-config.txt-usersigningKey Change-Id: I90dda7a6006011418a61af8a959691574d8a61b5

+3 −0

Author

Thomas Gerbet (tgerbet) 2022-03-07 16:40

Committer

Thomas Gerbet (tgerbet) 2022-03-07 16:47

Hash 65d4e8ec9ea9c0890c0b5852f114de946f85290e

Parent aed9ce22872c7a50ffdcbb5ca417561f40e12678

Reference git #tuleap/stable/65d4e8ec9ea9c0890c0b5852f114de946f85290e