Open Source Summit Europe 2022

Working with any software project, chances are you need to be familiar with Git. And open source projects in particular, are open to contribution from anyone - even individuals with less honorable intentions. How do you know that the name and email address on a commit is legitimate? Sadly, it's easy to fake, and a momentary lapse of attention can allow an ill-intended contribution to slip through the barriers. Enter Pretty Good Privacy (PGP), and it's implementation Gnu Privacy Guard (GPG)! This is a public key cryptography protocol and software package that can help you ensure those commits are from the right person. And by cross-signing each other's keys, you can build a "web of trust" among your fellow contributors to further strengthen the bond. Git supports signing commits with PGP! In this talk we will explore a little bit of background in public key encryption and set up your very own PGP public key. Then we will look at the integration between PGP and Git in the context of signing our Git commits, and even configuring Git to know which repositories to sign and which should be unsigned.