Commit signing service
Signing source code using a vault device is described. An example method can include receiving, with a client device, source code that is to be committed to a repository. The method further can include sending, with a processing device to a vault device, a request to sign the source code. The method can further include receiving, from the vault device, a signed commit of the source code. In addition, the method can include pushing the source code and the signed commit to the repository, wherein the repository commits the source code and signed commit.
1. A computer-implemented method comprising:
sending, to a vault device:
source code; and
signing key comprising developer credentials;
receiving, from the vault device:
a signed commit of the source code; and
a commit signature for the source code, wherein the commit signature for the source code is independent of the signing key; and
pushing, to a repository, the signed commit of the source code and the commit signature for the source code.
2. The computer-implemented method of claim 1 , wherein the source code is one of a programming file, build file, header file, image file, or audio/visual file.
3. The computer-implemented method of claim 1 , wherein the signed commit includes the source code and a cryptographic signature of the source code.
4. The computer-implemented method of claim 1 , wherein the vault device signs the source code.
5. The computer-implemented method of claim 1 , wherein:
the vault device signs the source code using a second signing key; and
the second signing key remains resident on the vault device.
6. The computer-implemented method of claim 5 , wherein the vault device generates the second signing key for a developer when the developer is not associated with a second signing key.
7. The computer-implemented method of claim 5 , wherein the second signing key, generated by the vault device, identifies a developer.
8. The computer-implemented method of claim 5 , wherein the second signing key is rotated on a schedule.
9. The computer-implemented method of claim 1 , wherein the vault device receives the source code and the signing key comprising developer credentials from a client device, and the client device is a device used by a developer to edit the source code.
10. The computer-implemented method of claim 1 , wherein the vault device is a device that is used to generate and store a second signing key.
11. The computer-implemented method of claim 1 , wherein the repository stores the source code after a commit.
12. A computer-implemented method comprising:
receiving, at a repository, a pull request for source code; and
performing a verification by:
sending, to a vault device, a stored commit signature for the source code, wherein:
the vault device retrieves a username associated with the stored commit signature for the source code and;
verifies the stored commit signature by computing a local commit signature for the source code using:
a locally stored first signing key associated with the username; and
a second signing key used by the username to submit the source code to the repository; and
receiving a verification status for the source code.
13. The computer-implemented method of claim 12 , further comprising returning the verification status to a device that sent the pull request.
14. The computer-implemented method of claim 12 , further comprising blocking a branch merge when the verification status indicates that the stored commit signature is different from the locally computed commit signature.
15. The computer-implemented method of claim 12 , further comprising invoking a build server to run a verification action.
16. The computer-implemented method of claim 12 , wherein a source code is one of a programming file, build file, header file, image file, or audio/visual file.
17. A system comprising:
a vault device; and
a client device, operatively coupled to the vault device, to:
send to the vault device:
source code; and
a signing key comprising developer credentials;
receive, from the vault device:
a signed commit of the source code; and
a commit signature for the source code, wherein the commit signature for the source code is independent of the signing key; and
push, to a repository, the signed commit of the source code and the commit signature for the source code.
18. The system of claim 17 , wherein the source code is one of a programming file, build file, header file, image file, or audio/visual file.
19. The system of claim 17 , wherein the signed commit comprises:
source code; and
a cryptographic signature.
20. The system of claim 17 , wherein the vault device signs the source code.
21. The system of claim 17 , wherein:
the vault device signs the source code using a second signing key; and
the second signing key remains resident on the vault device.
22. The system of claim 21 , wherein the vault device generates the second signing key for a developer when the developer is not associated with a second signing key.
23. The system of claim 21 , wherein the second signing key, generated by the vault device, identifies a developer.
24. The system of claim 17 , wherein the client device is a device used by a developer to edit the source code.
25. A non-transitory machine-readable medium storing instructions which, when executed by one or more processors of a computing device, cause the one or more processors to:
send, to a vault device:
source code; and
a signing key comprising developer credentials;
receive, from the vault device:
a signed commit of the source code; and
a commit signature for the source code, wherein the commit signature is independent of the signing key; and
push, to a repository, the signed commit of the source code and the commit signature for the source code.