Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

Sign commits created by Batch Changes with GitHub App (Tracking) #48611

@BolajiOlajide

Description

@BolajiOlajide

This issue is related to #15271.

We have requests from some of our customers to add an extra layer of security when creating changesets from a Batch Change to have the associated commits in a changeset signed by the author of the Batch Change. To achieve tho

The proposal here is to have users generate SSH keys on Sourcegraph, the private key will be encrypted and stored and used for creating commits, while the public key will be displayed to the user to be added to their code hosts.

Thanks to Erik, we have a draft PR here.

The scope of work involved to finish this implementation includes:

  • Extending the user credential and site admin credential types by a flag "I want signing bool" that can be toggled from the UI
    • If that is checked, we will show the generated SSH key regardless of if ssh on the code host is enabled
    • And inform the user that they need to store that key in their profile as a signing key
  • Polishing the gitserver part of that PR, likely want some testing and such
  • Adding some feature gating because older GitHub instances don't support this signing type
  • Investigating if GitLab supports this, implementing support for it if so
  • Documenting
  • Testing

Tracked issues

@unassigned

Completed

@BolajiOlajide

Completed

@courier-new

Completed

@st0nebraker

Completed

Stretch goal:

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions