Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for checking cert email against user config before signing. #246

Merged
merged 1 commit into from
Feb 23, 2023
Merged

Add support for checking cert email against user config before signing. #246

merged 1 commit into from
Feb 23, 2023
+171 −4

Commits on Feb 22, 2023

  1. Add support for checking cert email against user config before signing. 

    This change adds a new config option: gitsign.matchCommitter. This
option checks whether the certificate fetched matches the user
configured email/name.

For human users, this generally means that the SAN email in the cert
matches the `user.email` Git config option.

For non-email based identities (e.g.  machine users), the SAN URI can be
specified as the user name (since the URI isn't a valid email).

Gitsign requires at least one condition to match for the check to
succeed.

This change does *not* enforce any constraints on verification, since
this requires additional checking to know what IdP is considered valid.

Signed-off-by: Billy Lynch <[email protected]>
    @wlynch
    wlynch committed Feb 22, 2023
    Configuration menu
    Copy the full SHA
    60b6656 View commit details
    Browse the repository at this point in the history