Commit verification with SSH signed commits possible?

[dakky]

At the moment its possible ti let flux accept only signed commits (see https://fluxcd.io/flux/components/source/gitrepositories/#verification)

The examples are only mentioning GPG signed commits. Github and Gitlab also allow SSH signed commits.
Can flux also handle ssh pub keys in order to verify the commit?

[makkes]

go-git, the upstream library we use in Flux, doesn't support this, yet, but as soon as that issue is addressed, we will start incorporating it into Flux itself.

[dakky]

Thanks: the upstream issue is go-git/go-git#400

[hiddeco]

We theoretically have the means now to do manual verification outside of go-git. As I am currently having issues with finding time to finish go-git/go-git#705, but did take the time to write https://github.com/hiddeco/sshsig.

Only downside is that there is no bit yet which understands an allowed signers entry, which would mean we would have to continue the work in hiddeco/sshsig#7 to at least be able to connect a principal (email address) to an allowed public key.

[hkrutzer]

That issue has been closed with go-git/go-git#1849 as a followup, does this feature now depend on that followup issue?

[bb-Ricardo]

does this help?: fluxcd/pkg#1141