Using Git Commit Signing

This topic contains the following sections:

Signing Customer Git Commit
Rotating Git Signing Keys

You can enable Git commit signing to add a cryptographic signature to each Git commit. The signature proves that the change was made by a trusted customer or SCM signing identity.

SCM uses the signature so that Flux applies repository changes only when the latest commit is signed by a trusted GPG key.

SCM Git commit signing supports GPG (GNU Privacy Guard) keys. Use an RSA GPG key with a minimum key size of 3072 bits. You can use 4096 bits if your customer security policy allows it.

The following table describes the signing keys that SCM uses:

Key Type	Used For	Customer Input
CUSTOMER	Customer or customer automation commits.	GPG public key file required.
SCM	SCM-generated commits during install, migration, upgrade, or maintenance.	No input required. SCM manages this key.
FLUX	Flux image automation commits, when image automation is enabled.	No input required. SCM manages this key.

To enable Git commit signing, add the commit_signing section under infrastructure.git in the environment or configuration request. For example:

"commit_signing": {
    "enabled": true,
    "customer_public_key_file": "/home/opc/customer-signing-public-key.asc"
}

By default, the Git commit signing is disabled. When signing is disabled, you don’t need to provide a customer GPG public key file. For more information on the parameters, see Payload Parameters for Siebel CRM Deployment.

Signing Customer Git Commit

To sign customer Git commit, you must run the following commands in the Git repository where customer commits are made:

git config user.signingkey <CUSTOMER_GPG_KEY_ID>
git config commit.gpgsign true

After you run the above commands, normal Git commit commands are signed automatically.

To sign one commit manually, you run the following:

git commit -S -m "commit message"

To verify the signature for the last commit, you can run:

git log --show-signature -1

You must use the customer private key that matches the public key file that you provide to SCM.

Rotating Git Signing Keys

You can rotate Git signing keys when required by your organization’s security policy or when a trusted signing key must be replaced. You can use the key rotation git_sign_key_rotate API to change a trusted Git signing key after deployment.

To rotate a Git signing key:

Create a request body as follows:
1. For customer signing key:
```
{
    "env_id": "<environment-id>",
    "type_of_key": "CUSTOMER",
    "customer_public_key_file": "/home/opc/new-customer-signing-public-key.asc"
}
```
2. For SCM and Flux signing keys:
```
{
    "env_id": "<environment-id>",
    "type_of_key": "<SCM or Flux>"
}
```
The type_of_key value can be CUSTOMER, SCM, or FLUX. The customer_public_key_file value is required only for CUSTOMER rotation.
Submit request body using the POST method:
```
POST /scm/api/v1.0/git_sign_key_rotate
```

You can also enable mandatory signed commits in your Git server or branch settings if your Git provider supports this option. You configure this setting outside SCM.