[Feature request] Request the last git commit to be signed

[hoh]

Since comin can update it's own configuration from a git repository, trust in the repository seems absolute and a compromise of the forge could lead to a compromise of the machine.

Requiring the last git commit to be signed with a GPG key would add an extra security, requiring an adversary to not only compromise the forge and/or the repository, but obtaining the private key of one of the approved committers as well.

This would also allow unauthorized committers to publish to the repository while only commits signed with an preauthorized key would trigger an update of the system.

Requiring updates to be upstream the current configuration would help avoiding unauthorized rollbacks, preventing replay attacks.

[nlewo]

Requiring the last git commit to be signed with a GPG key

That's definitively planned and I actually created comin to replace a deployment bach script that checks Git commit are signed. This should be implemented in the two next releases.

Requiring updates to be upstream the current configuration would help avoiding unauthorized rollbacks, preventing replay attacks.

I'm sorry but I don't understand what you mean.
But, in order to avoid unauthorized rollbacks, comin already do not allow hard reset on the main branches.

Also, i actually didn't clean correctly the code base since there are some currently dead code ;)

[hoh]

That's great, looking forward to it !

Not allowing hard resets on the main branches solves the unauthorized rollbacks, good to read that this is handled already.

[Luflosi]

Also, i actually didn't clean correctly the code base since there are some currently dead code ;)

The code you linked looks like it already does check the signature of commits. Does this mean, that this feature is mostly implemented already and "just" needs to be wired up (e.g. config option for the key to use)?

[nlewo]

I wrote a draft in #64.