Security: SSH Commit Signing Enabled #32

New issue

Closed

opened 2026-05-02 19:47:51 +00:00 by agent-cos · 1 comment

agent-cos commented

2026-05-02 19:47:51 +00:00

SSH Commit Signing Enabled ✅

Configuration Complete

Signing Key Generated:

Type: ED25519
Location: ~/.ssh/wardrobe-ai-signing
Fingerprint: SHA256:j8oNRynZpHi9J/88AVzxOq9cRYl1kxiVaWetHtLTZqE
Email: wardrobe-ai@scoble.me

Git Configuration:

user.signingkey = ~/.ssh/wardrobe-ai-signing
commit.gpgsign = true
gpg.format = ssh
gpg.ssh.allowedsignersfile = ~/.ssh/allowed_signers

Forgejo Integration:

Key ID: 2
Title: wardrobe-ai-signing
Added to user profile: https://os.scoble.me/forgejo/user/settings/keys

Verified:

Test commit: ab69d48 — "Enable SSH commit signing"
Signature status: ✅ Good signature verified by Forgejo

For All Contributors

Any agent committing to this repo must:

Generate an SSH signing key: ssh-keygen -t ed25519 -C "agent@scoble.me"
Add public key to their Forgejo profile
Configure git: git config --local commit.gpgsign true and git config --local gpg.format ssh
Use git commit -S for all commits

Branch Protection Recommendation

Enable "Require signed commits" in repo settings for main branch.

## SSH Commit Signing Enabled ✅ ### Configuration Complete **Signing Key Generated:** - Type: ED25519 - Location: `~/.ssh/wardrobe-ai-signing` - Fingerprint: `SHA256:j8oNRynZpHi9J/88AVzxOq9cRYl1kxiVaWetHtLTZqE` - Email: `wardrobe-ai@scoble.me` **Git Configuration:** ``` user.signingkey = ~/.ssh/wardrobe-ai-signing commit.gpgsign = true gpg.format = ssh gpg.ssh.allowedsignersfile = ~/.ssh/allowed_signers ``` **Forgejo Integration:** - Key ID: 2 - Title: `wardrobe-ai-signing` - Added to user profile: https://os.scoble.me/forgejo/user/settings/keys **Verified:** - Test commit: `ab69d48` — "Enable SSH commit signing" - Signature status: ✅ Good signature verified by Forgejo ### For All Contributors Any agent committing to this repo must: 1. Generate an SSH signing key: `ssh-keygen -t ed25519 -C "agent@scoble.me"` 2. Add public key to their Forgejo profile 3. Configure git: `git config --local commit.gpgsign true` and `git config --local gpg.format ssh` 4. Use `git commit -S` for all commits ### Branch Protection Recommendation Enable "Require signed commits" in repo settings for `main` branch.

agent-cos commented

2026-05-03 07:59:43 +00:00

Author

Re-groomed: Outcome-based format

What "done" looks like

Every commit to the Wardrobe AI repo is cryptographically signed, proving who wrote it. If someone asks "who changed this?" or "when did this break?", the answer is verifiable. This is a prerequisite for any external contributor or vendor audit.

Outcome

Commit history is tamper-evident
External parties (investors, acquirers, auditors) can verify authorship
The repo meets the security baseline for a product handling user data

Context

Current state: SSH commit signing is configured in the repo settings
Need to verify: are all recent commits actually signed?
Check: git log --show-signature or Forgejo commit list
If commits are unsigned, need to enforce signing or retroactively document why

Agent should know

This is a verification task, not a code task
If signing is already working, close this issue with evidence
If not working, document what's needed (SSH key setup, git config, etc.)

Verification

git log --show-signature -5  # should show "Good signature" on recent commits

## Re-groomed: Outcome-based format ### What "done" looks like Every commit to the Wardrobe AI repo is cryptographically signed, proving who wrote it. If someone asks "who changed this?" or "when did this break?", the answer is verifiable. This is a prerequisite for any external contributor or vendor audit. ### Outcome - Commit history is tamper-evident - External parties (investors, acquirers, auditors) can verify authorship - The repo meets the security baseline for a product handling user data ### Context - Current state: SSH commit signing is configured in the repo settings - Need to verify: are all recent commits actually signed? - Check: `git log --show-signature` or Forgejo commit list - If commits are unsigned, need to enforce signing or retroactively document why ### Agent should know - This is a verification task, not a code task - If signing is already working, close this issue with evidence - If not working, document what's needed (SSH key setup, git config, etc.) ### Verification ``` git log --show-signature -5 # should show "Good signature" on recent commits ```