radicle-dev / radicle-client-services

Services backing the Radicle client interfaces.
Apache License 2.0
31 stars 13 forks source link

http-api: Add commit signature verification to history handler #132

Closed sebastinez closed 2 years ago

sebastinez commented 2 years ago

A first implementation of commit signature verification.

Using git show <commit> --pretty'%GF' --raw we are able to verify that a commit has a valid signature and return the corresponding fingerprint. On the other side we obtain all the peers from the seed node and check if they match the commit signature information.

At the moment we only verify ssh signatures that match a valid Person later we eventually will verify GPG signatures or third party SSH signatures.

sebastinez commented 2 years ago

Okay did a rebase fixed conflicts with the pagination PR merge and addresses all the open issues in the most idiomatic Rust way.