How are you supposed to do git signed commits/tags without putting gpg private keys on your development box/account?!
-
-
Replying to @RichFelker1 reply 0 retweets 0 likes
-
Replying to @CopperheadOS @CopperheadSec
Unfortunately subkeys don't solve the problem when I seem to need the tags signed by the more-trusted key...
1 reply 0 retweets 0 likes -
Replying to @RichFelker @CopperheadSec
What I want is a way to process the signing request on a secure remote with minimal attack surface.
1 reply 0 retweets 0 likes -
Replying to @RichFelker @CopperheadSec
does "export remote filesystem via sshfs to the trusted box and sign" count?
1 reply 0 retweets 0 likes -
Replying to @kdaveh @CopperheadSec
No, because the trusted box should not be processing complex data like a git repo, only the text to be signed.
1 reply 0 retweets 0 likes -
Replying to @RichFelker @CopperheadSec
I see. git offers gpg.program config so you'd have to provide a stub to forward the request to the trusted host
1 reply 0 retweets 0 likes -
Replying to @kdaveh @CopperheadSec
I'm trying to do that, but getting stdin/out to work AND getting a pty for passphrase entry is quite difficult.
1 reply 1 retweet 0 likes -
Replying to @RichFelker @CopperheadSec
I'd try to wire local pinentry to remote gpg --*-fd options, but it I assume getting that right could be tricky
1 reply 1 retweet 0 likes
I got a working solution with nc over ssh tcp tunnels and a lot of fd redirection hacks. It's ugly but it works.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.