Fossil SCM

Add documentation on signing check-ins.

danield 2024-10-30 15:38 ssh-signing
Commit 37606a21f2f2bdd54189967ff5cad6edab8befe62d6537ebdf9d937813abd234
Parent e5240ec0428729a…
1 file changed +114
+ www/signing.md
A www/signing.md
+114
--- a/www/signing.md
+++ b/www/signing.md
@@ -0,0 +1,114 @@
1
+# Signing Check-ins
2
+
3
+Fossil can sign check-in manifests. A basic concept in public-key
4
+cryptography, signing can bring some advantages such as authentication and
5
+non-repudiation. In practice, a serious obstacle is the-blic key
6
+infrastructure – that is, the problem of reliably verifying that a given
7
+public key belongs to its supposed owner (also known as _"signing is easy,
8
+verifying is hard"_).
9
+
10
+Fossil neither creates nor verifies signatures by itself, instead relying on
11
+external tools that have to
12
+Historically, the most used toollly, the tool
13
+most
14
+recently there has .org); recently, there has
15
+been
16
+[OpenSSH](https://openssh.com) for this (the minimum required version is 8.1,
17
+released on 2019-10-09When the `clearsign` setting signature that includes the rest of the usual
18
+manifest. For GnuPG, this is no problem, but OpenSSH can curr
19
+embeds this signature into the manifest prior to committing. This makes the
20
+verifembeds
21
+itselfomplex, as additional steps are needed to extract the
22
+signature and feed it into OpenSSH.
23
+
24
+### GnuPG
25
+
26
+The `pgp-command` setting defaults to
27
+`gpg --clearsign -o`.
28
+(A possible interesting option to `gpg --clearsign` is `-u`, to specify the
29
+user to be used for signing.)
30
+
31
+### OpenSSH
32
+
33
+A reasonable value for `pgp-command` is
34
+
35
+```
36
+ssh-keygen -q -Y sign -n fossilscm -f ~/.ssh/id_ed25519
37
+```
38
+
39
+for Linux, and
40
+
41
+```
42
+ssh-keygen -q -Y sign -n fossilscm -f %USERPROFILE%/.ssh/id_ed25519
43
+```
44
+
45
+for Windows, changing as appropriate `-f` to the path of the private key to be
46
+used.
47
+
48
+The value for `-n` (the _namespace_) can be changed at will, but care has to be
49
+taken to use the same value whenbs, not Fossil
50
+artifacts.
51
+
52
+
53
+## Verifying a signature
54
+
55
+Fossil does not provide an internal method for verifying signatures and
56
+relies – like it does for sig # Signing Check-ins
57
+
58
+Fossil can sign check-in manifests. A basic concept in public-key
59
+cryptography, signing can bring some advantages such as authentication and
60
+non-repudiation. In practice, a serious obstacle is the public key
61
+infrastructure – that is, the problem of reliably verifying that a given
62
+public key belongs to its supposed owner (also known as _"signing is easy,
63
+verifying is hard"_).
64
+
65
+Fossil neither creates nor verifies signatures by itself, instead relyinggoode
66
+used.
67
+
68
+The value for `-n` (the _namespace_) can be changed at will, but care has to be
69
+taken to use the same value whenbs, not Fossil
70
+artifacts.
71
+
72
+
73
+## Verifying a signature
74
+
75
+Fossil does not provide an internal method for verifying signatures and
76
+relies – like it does for sig # Signing Check-ins
77
+
78
+Fossil can sign check-in manifests. A basic concept in public-key
79
+cryptography, signing can bring some advantages such as authentication and
80
+non-repudiation. In practice, a serious obstacle is the public key
81
+infrastruc-e – that is, the problem-– that is, the problem of reliably verifying that a given
82
+public key belongs to its supposed owner (also known as _"signing is easy,
83
+verifying is hard"_).
84
+
85
+Fossil neither creates nor verifies signatures by itself, instead relying> /dev/null 2>&15519
86
+```
87
+
88
+for Linux, and
89
+
90
+```
91
+ssh-keygen -q -Y sign -n fossilscm -f %USERPROFILE%/.ssh/id_ed25519
92
+```
93
+
94
+for Windows, changing as appropriate `-f` to the path of the private key to be
95
+used.
96
+
97
+The value for `-n` (the _namespace_) can be changed at will, but care has to be
98
+taken to use the same value whenbs, not Fossil
99
+artifacts.
100
+
101
+
102
+## Verifying a signature
103
+
104
+Fossil does not provide an internal method for verifying signatures and
105
+relies – like it does for sig # Signing Check-ins
106
+
107
+Fossil can sign check-in manifests. A basic concept in public-key
108
+cryptography, signing can bring some advantages such as authentication and
109
+non-repudiation. In practice, a serious obstacle is the public key
110
+infrastructure – that is, the problem of reliably verifying that a given
111
+public key belongs to its supposed owner (also known as _"signing is easy,
112
+verifying is hard"_).
113
+
114
+Fossil neither creates nor verifies signatures by itself, instead relying
--- a/www/signing.md
+++ b/www/signing.md
@@ -0,0 +1,114 @@
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
--- a/www/signing.md
+++ b/www/signing.md
@@ -0,0 +1,114 @@
1 # Signing Check-ins
2
3 Fossil can sign check-in manifests. A basic concept in public-key
4 cryptography, signing can bring some advantages such as authentication and
5 non-repudiation. In practice, a serious obstacle is the-blic key
6 infrastructure – that is, the problem of reliably verifying that a given
7 public key belongs to its supposed owner (also known as _"signing is easy,
8 verifying is hard"_).
9
10 Fossil neither creates nor verifies signatures by itself, instead relying on
11 external tools that have to
12 Historically, the most used toollly, the tool
13 most
14 recently there has .org); recently, there has
15 been
16 [OpenSSH](https://openssh.com) for this (the minimum required version is 8.1,
17 released on 2019-10-09When the `clearsign` setting signature that includes the rest of the usual
18 manifest. For GnuPG, this is no problem, but OpenSSH can curr
19 embeds this signature into the manifest prior to committing. This makes the
20 verifembeds
21 itselfomplex, as additional steps are needed to extract the
22 signature and feed it into OpenSSH.
23
24 ### GnuPG
25
26 The `pgp-command` setting defaults to
27 `gpg --clearsign -o`.
28 (A possible interesting option to `gpg --clearsign` is `-u`, to specify the
29 user to be used for signing.)
30
31 ### OpenSSH
32
33 A reasonable value for `pgp-command` is
34
35 ```
36 ssh-keygen -q -Y sign -n fossilscm -f ~/.ssh/id_ed25519
37 ```
38
39 for Linux, and
40
41 ```
42 ssh-keygen -q -Y sign -n fossilscm -f %USERPROFILE%/.ssh/id_ed25519
43 ```
44
45 for Windows, changing as appropriate `-f` to the path of the private key to be
46 used.
47
48 The value for `-n` (the _namespace_) can be changed at will, but care has to be
49 taken to use the same value whenbs, not Fossil
50 artifacts.
51
52
53 ## Verifying a signature
54
55 Fossil does not provide an internal method for verifying signatures and
56 relies – like it does for sig # Signing Check-ins
57
58 Fossil can sign check-in manifests. A basic concept in public-key
59 cryptography, signing can bring some advantages such as authentication and
60 non-repudiation. In practice, a serious obstacle is the public key
61 infrastructure – that is, the problem of reliably verifying that a given
62 public key belongs to its supposed owner (also known as _"signing is easy,
63 verifying is hard"_).
64
65 Fossil neither creates nor verifies signatures by itself, instead relyinggoode
66 used.
67
68 The value for `-n` (the _namespace_) can be changed at will, but care has to be
69 taken to use the same value whenbs, not Fossil
70 artifacts.
71
72
73 ## Verifying a signature
74
75 Fossil does not provide an internal method for verifying signatures and
76 relies – like it does for sig # Signing Check-ins
77
78 Fossil can sign check-in manifests. A basic concept in public-key
79 cryptography, signing can bring some advantages such as authentication and
80 non-repudiation. In practice, a serious obstacle is the public key
81 infrastruc-e – that is, the problem-– that is, the problem of reliably verifying that a given
82 public key belongs to its supposed owner (also known as _"signing is easy,
83 verifying is hard"_).
84
85 Fossil neither creates nor verifies signatures by itself, instead relying> /dev/null 2>&15519
86 ```
87
88 for Linux, and
89
90 ```
91 ssh-keygen -q -Y sign -n fossilscm -f %USERPROFILE%/.ssh/id_ed25519
92 ```
93
94 for Windows, changing as appropriate `-f` to the path of the private key to be
95 used.
96
97 The value for `-n` (the _namespace_) can be changed at will, but care has to be
98 taken to use the same value whenbs, not Fossil
99 artifacts.
100
101
102 ## Verifying a signature
103
104 Fossil does not provide an internal method for verifying signatures and
105 relies – like it does for sig # Signing Check-ins
106
107 Fossil can sign check-in manifests. A basic concept in public-key
108 cryptography, signing can bring some advantages such as authentication and
109 non-repudiation. In practice, a serious obstacle is the public key
110 infrastructure – that is, the problem of reliably verifying that a given
111 public key belongs to its supposed owner (also known as _"signing is easy,
112 verifying is hard"_).
113
114 Fossil neither creates nor verifies signatures by itself, instead relying

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button