search

signet-org / signet-python

A decentralized code signing network
MIT License
23 stars 1 forks source link

Github integration #5

Open chromakode opened 8 years ago

chromakode commented 8 years ago

It should be easy to publish your personal sig repo to a Github repository. Perhaps using gh-pages?

bengl commented 8 years ago

Could a github user's already-public ssh keys be used to signed? e.g. https://github.com/chromakode.keys

chromakode commented 8 years ago

Interesting idea! In theory this is possible, you can convert from SSH -> OpenSSL -> GPG. The question would be how to verify the authenticity of the keys you get from GitHub -- in the naive case, it's just proof of GitHub auth. I prefer distributing/obtaining keys through a service like KeyBase since there are multiple points of verification, both through social media accounts and signing. An SSH key could work as an alternative to setting up gpg, though in many ways it's also advantageous to segregate your signing and authentication keys -- for security purposes, generating a separate key for code signing is probably a safer bet. What are your thoughts on this?