git signature verification

[jimmyjones2]

Git supports signing commits/tags with PGP. If flux could be configured with a set of allowed PGP keys, it would add another layer of defense.

As it stands, if someone can manage to commit (eg. insider, previous employee with unrevoked access, unpatched git sever, stolen domain creds etc) they can compromise the entire cluster. You'll have an audit log and hopefully someone should notice which is way better than the status quo, but this could further improve the already great security story of flux.

[hiddeco]

Is it correct to assume the feature you are describing is being worked on in #1394?

Did not consume my kick start amount of ☕ yet. You actually want to provide a list of allowed PGP keys and block the execution of commits if the PGP key of the commit does not match the whitelist. Which is a solid feature.

This is blocked by #1394 as Flux pushes updates to Git and applies them by pulling them from Git in a separate loop. Without being able to sign the commit Flux would be unable to apply them with a PGP whitelist in place.