Git Commit Signing with Trusted Artifact Signer
1. Prerequisites
-
Clone the workshop apps repo: Deploy the Workshop Applications
-
Complete Container Signing setup (environment variables +
cosign initialize) unless already done.
2. Setting up gitsign
Configure git to sign commits with gitsign using the same Fulcio/Rekor/OIDC endpoints as container signing.
cd /home/lab-user/demo-apps
git statusPush the repo to the cluster GitLab instance ({gitlab_url}) using credentials {gitlab_user} / {gitlab_user_password}:
export GITLAB_REPO_URL=https://$(oc get route gitlab -n gitlab | tail -n 1 | awk '{print $2}')/user1/demo-apps.git
git remote remove origin 2>/dev/null || true
git remote add origin $GITLAB_REPO_URL
git push --set-upstream origin mainConfigure local git for X509/gitsign signing:
git config --local commit.gpgsign true
git config --local tag.gpgsign true
git config --local gpg.x509.program gitsign
git config --local gpg.format x509
git config --local gitsign.fulcio $SIGSTORE_FULCIO_URL
git config --local gitsign.rekor $SIGSTORE_REKOR_URL
git config --local gitsign.issuer $SIGSTORE_OIDC_ISSUER
git config --local gitsign.clientID trusted-artifact-signer3. Sign and push a commit
touch make-a-commit.txt
git add .
git commit -m "added an empty file"Complete Keycloak browser authentication when prompted (copy the full verification code from the success page).
The committer name in git metadata can be set locally; the cryptographic signer identity (e.g. jdoe@redhat.com) comes from OIDC and is recorded in Rekor.
|
git pushGitLab may show an "unverified" badge—it detects a signature but does not yet validate keyless Sigstore signatures natively.
4. Verify the commit signature
Inspect the signature metadata:
gitsign showVerify against Rekor and the trust root for a specific identity:
gitsign verify --certificate-identity=jdoe@redhat.com --certificate-oidc-issuer $OIDC_ISSUER_URLOr verify any Red Hat signer authenticated via your cluster OIDC domain:
gitsign verify --certificate-identity-regexp ^[a-zA-Z0-9._%-]@redhat\.com$ --certificate-oidc-issuer-regexp \.opentlc\.comExpected: Certificate claims validate against Fulcio and the Rekor transparency log.
5. Summary
Keyless signing works for git commits the same way as container images: Sigstore clients sign, Fulcio binds identity, Rekor witnesses the event—no long-lived GPG key pairs to distribute.
6. Next module
Continue to Trusted Profile Analyzer.
