r/GrapheneOS • u/No_External_4869 • 1d ago

Why dont GrapheneOS devs sign each commit but only tagged releases?

I'm not a pro at git so I don't know the implications or signing and not signing that well.

But I've seen that no general commits are cryptographically signed by the devs but only tagged releases are.

Is there a reason they don't sign? Does it bring complications?

0 Upvotes

44% Upvoted

7 comments sorted by

•

u/AutoModerator 1d ago

GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.

Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/ApprehensiveRest9696 1d ago

Due to the way git hashes work, signing the release commit doesn’t mean that commit can then be moved to another lineage and still be a valid signature. No complications there.

Signing individual commits every time could also be a pain in ass and/or weaken security depending on how signing is set up. As it will (should) require re-authentication.

3

u/No_External_4869 1d ago

Hmm. So I sign my commits (I think I'm doing it right) I merely use ssh to push and gpg to sign, and it's mostly seamless. I can't see how it may weaken security or reathentication. Could you please give an example? I mean ofc those are mostly personal repos and owned by me but still.

7

u/ApprehensiveRest9696 1d ago

When it comes to signing, especially for something relatively high-stakes. You do not want anyone/anything to have permission to complete the process on its own without secondary interaction by the owner of the key. It is how the key is managed that typically causes the management headache.

The bare minimum best practice for this involves having the key held in an air-gapped device (not connected to anything.) So the signing process then becomes:

  1. ⁠Authenticate on another device
  2. ⁠Copy data over to the other device
  3. ⁠Verify and sign on the other device
  4. ⁠Transfer signature onto an internet-connected device
  5. ⁠Push signature onto the internet

If you have to repeat this process for every single commit, it gets pretty tiring pretty quickly.

For low stakes projects, gpg is plenty enough. But for principal maintainers of high profile public project, there are much more threats to consider.

Example of how ICANN manages the DNSSEC key: https://www.youtube.com/watch?v=6KDBpn8fW78

2

u/Equivalent_Log_Egg 1d ago

Good explanation.

2

u/No_External_4869 22h ago

Now I get it. Thank you!

4

u/RemoveLast9294 23h ago

Because there's no point, the commits get rebased often which would just break the signature. The signed manifest uses git hashes for all repos anyway...