keeper-security/git-ssh-sign

Git SSH sign feature for Keeper Secrets Manager

git-ssh-sign's Issues

Add Pull Request and Issue Templates to the project

Templates for issues and pull requests ensure that all required information is available for reviewers speeding up the collaboration and increasing the likelihood of success pull request.

Fix output to match ssh-keygen

As this replaces ssh-keygen as the signing binary for the SSH signing workflow, the user should expect the outputs to be the same as if the default is used for a consistent experience.

git itself also error checks against the first word in the output: https://github.com/git/git/blob/master/gpg-interface.c#L583

[Question] How did you build this?

Hi 👋

For educational purpose, I'd like to know if you still had documentation about how git interacts with ssh-keygen to sign commits, unless you reverse-engineered the way git was doing it?

I can't seem to find any documentation about the steps git follows to sign commits with an SSH key, and I am really curious about how you knew what to build 😊

Make Public Key Optional in Keeper Record

Feature / Enhancement proposed

Currently a successful signing of the git commit can only occur if both the private and public keys are available in the Keeper Record. As the public key can always be derived from the private key, then if no public key is explicitly set in the Keeper record, then one will be automatically derived from private key.

Workarounds

Can you achieve the same result doing it in an alternative way? Nope

Has the feature been requested before?

No.

If the feature request is approved, would you be willing to submit a PR?

(Help can be provided if you need assistance submitting a PR)

[x] Yes [] No

Add `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md`

These files outline expectations and set up contributors for success. Leading to a more positive and collaborative project.

Add the ability to verify locally

If using the default ssh-keygen for signing commits, you can use it to verify commits locally with commands like:

git log --show-signature -1

As this project is a direct replacement for ssh-keygen with the benefit of using a key stored in the Keeper Vault, it should also verify commits locally.

Panic Error when binary ran by a user has no context.

When the user calls the binary directly, a panic error is shown.

panic: runtime error: index out of range [-1]

goroutine 1 [running]:
main.main()
	/home/runner/work/git-ssh-sign/git-ssh-sign/cmd/ssh-sign/main.go:37 +0x2ac

This should be more elegant and feedback to the user this is a binary intended to be ran by git itself, not the user.

Update command line parsing & Error handling

Command line inputs should be appropriately parsed, and error handling should be added. It should return a non-zero exit status if:

• the namespace is not git
• the action (-Y) is not to sign

This is required before adding additional features such as supporting verification.