Author Blame, Commit Signing and Key Management

Feature Request, opened for discussion between my betters.

Summary:

• Indicate signed/unsigned status on commits by default
  • Include a path to view/verify signature
• Add user account setting for uploading public certificate
• Add repository setting to require signed commits
• Pair commit signatures with ACL for repository access permissions
• Consider change to attribution of commits to "Gogs"

I notice in prodding my test instance that there is no treatment for committer signing on commits. At the repo commits screen (http://localhost:3000/victor/DVS/commits/master) and elsewhere, there is no indication of signed or unsigned status.

In user account settings we have SSH key treatment (http://localhost:3000/user/settings/ssh), and I suspect that a similar page (or the same page, reworded) would fit for uploading a signing key, when that is different from the SSH key.

In repository settings (http://localhost:3000/victor/DVS/settings) one might expect to find an option for requiring signed commits. There may also be an interface for selecting "allowed" user signatures in that repository, where the Gogs interface would assign trust based on Gogs user accounting, but would enforce it by user-provided keys. I'm unclear on the implications of this in regard to the existing Collaborators interface.

This seems to pair nicely with the concepts of "private repositories" and "organizations" as a form of ACL, and may open a good way to accomplish policy enforcement down the line.

Samples of this behavior and its cases are in Git Book v2 on Git-Enforced Policies, Stack Overflow on enforcing author name and Mike Gerwitz on Ensuring Trust in git.

All of this, of course, can be done directly on git, before Gogs is pointed at a repo, or after Gogs as made a repo (and then, also in Gogs' Git Hooks interface).

Relatedly, when Gogs does its first run (in my first test) it writes its own user credentials to ~/.gitconfig, making itself the global committer on behalf of the user. That may be a separate issue (I don't know its behavior in all respects), but it certainly needs review on this issue, since it lets anonymous committers push to the repo as "Gogs", where "Anonymous" or some other ascertainable name would be better.

Start by reviewing the commits screen, user settings SSH-key page, repository settings, and the first-run ~/.gitconfig behavior described in the issue, then compare the linked Git-enforced policy examples. Because the request spans signature display, key management, repository policy, ACLs, attribution, and trust, define a narrower scope and acceptance criteria before implementation; done cannot be determined from the current issue.