pmjohann/signgit repository overview

⁠Containerized git signer

⁠Why?

GnuPG⁠ is 490,000+ lines of code which doesn't make anyone want to perform an audit. While RFC 4880⁠ looks great, I do not trust the implementation, so do not want to run it on my host. We've already seen severe vulnerabilities with major "trusted" crypto libs so far like GnuTLS⁠. If you can run it properly isolated, why risk running it on the host at all?

⁠How to run

You could add something like this in your .bashrc or .zprofile:

signgit () {
    docker run --rm -it \
    -e EDITOR=vi \
    -v ${HOME}/.gnupg:/keys:ro \
    -v ${HOME}/.gitconfig:/conf:ro \
    -v ${PWD}:/repo \
    pmjohann/signgit $@
}

You can use the "commit" and "tag" subcommands. An $EDITOR of your choice defined in the function snipped above will appear to type your message.

⁠To create a signed commit

signgit commit

⁠To create a signed tag

signgit tag v1.0.0