This is a bit of frustration post. I’m not a professional and some stuff is super confusing. And it might not even be programming only, as this seems to be a general issue when it comes to signing and security in computers. Every time I have to reinstall my operating system (its really only a few times in a decade), one of the things i fear most is signing into Github, signing keys and setting up local git on my Linux machine. I want the verified badge. Every time its a fight in understanding and doing the right steps, creating gpg keys and access tokens and such.

Am I the only one who struggles with this? Right now I have set it up and my test repository has the badge again. Do people care about this? Especially people like me who does a few little CLI and scripts and nothing else. Am I doing enterprise level security for the sake of an icon or is this really more secure? I do not have ANY professional background. As said I seem to have setup correctly now, so this is not asking for troubleshooting. Just wanted hear about your opinion and experience, and if any of you care.

  • Sickday@kbin.earth
    10·
    12 days ago

    In my work organization, we don’t allow pushes from users that have not signed their commits. We also frequently make use of git blame along with git verify-commit. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We’re a medium-sized FinTech organization though, so it’s very important we keep track of who is touching what.

    That said, I can’t see it being all that important to an individual unless they’re very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and home-manager, I use the programs.git module to setup automatic signing and key selection. I really haven’t touched it at all in years now. It was very “set it and forget it” for me.

    • thingsiplay@beehaw.orgOP
      4·
      12 days ago

      Someone else suggested SSH instead too. I will have this in mind for the next time when I struggle with gpg. I also learned that I can reuse my existing gpg setup, so maybe I do not need SSH.

      • MajorHavoc@programming.dev
        3·
        12 days ago

        maybe I do not need SSH.

        Heh. FYI, I’ve heard those words paired later with “fuck, I should have just used SSH”, fairly often.

  • MajorHavoc@programming.dev
    41·
    13 days ago

    This is my moment to shine. I hire developers specifically for their Cybersecurity qualifications, and I always look at their GitHub profiles.

    So… There’s like a security badge you can get? Neat.

    But no, I guess I don’t care about that.

  • cherrykraken@lemmy.ca
    2·
    13 days ago

    Regarding access tokens, there’s a third party credential helper for Linux that uses OAuth. I recently found it and started using it a month ago. Works pretty much the same as Git + Windows Credential Manager. In case you are running headless, there is a device mode flag that will allow you to login with the GitHub app on your phone.

    https://github.com/hickford/git-credential-oauth

    (And if you layer a timed cache helper before the OAuth helper… well you shouldn’t have to reauthenticate every time!)

    Otherwise, the Git manual lists some other credential helpers that interface with some password managers.

    https://git-scm.com/doc/credential-helpers

    • thingsiplay@beehaw.orgOP
      11·
      12 days ago

      My goal is to use git only. The problem for me is, this application “git-credential-oauth” is not in the official repository of my distribution. Which is a huge no-no for security related stuff in my opinion.

  • Flamekebab@piefed.socialEnglish
    33·
    12 days ago

    It’s one of several reasons I moved to another platform. The amount of faff wasn’t worth it for the few projects I fiddle with.

    • Aatube@kbin.melroy.org
      42·
      12 days ago

      this is a security thing, not a taft thing. you don’t need to sign commits to push them

      plus gitlab and sourcehut are so much better

      • Flamekebab@piefed.socialEnglish
        1·
        12 days ago

        OP asked for:

        Just wanted hear about your opinion and experience, and if any of you care.

        I found the level of security required for basic functionality to be a hindrance. For small personal projects it felt like squashing a fly with a sledgehammer. A remote repo that is too much hassle to use is functionally the same as not using one.

        plus gitlab and sourcehut are so much better

        I think I’ll just edit out a mention of the platform I moved to. I wasn’t advocating for it. To be a bit more constructive - what makes those alternatives better?

        • Aatube@kbin.melroy.org
          3·
          12 days ago

          Commit signing is not required for any functionality, unless you opt-in to some repository setting which you have to find for yourself first.

          These alternatives have vastly better UI that also layout the screen much more efficiently and have more features. I find it much easier to locate information on platforms that aren’t Forgejo/Codeberg. Sourcehut’s federation through email also just works.