6 ms·

Secretive (and the similar built-in functionality [1]) both allow you to require TouchID too. I found an okay balance using two SSH keys: one for commit signing

Secretive (and the similar built-in functionality [1]) both allow you to require TouchID too. I found an okay balance using two SSH keys: one for commit signing (w/o TouchID) and one for everything else (requires TouchID, or PIN on Linux) So, the actions that I really don't want the agent to take (establishing an SSH connection, pushing to a git remote) always require my manual intervention. [1] https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb4acf https://gist.github.com/arianvp/5f59f1783e3eaf1a2d4cd8e952bb...

danielheath 2mo ago
... you're getting the agent to sign commits for you without manual intervention?
- samhclark 2mo ago
  Yeah. The agent can create commits and those commits are signed (`commit.gpgsign true`). I'm treating it like...you can hold me accountable for that commit and the commit came from my computer. That feels like the right spirit of things. How do you do commit signing? I've never worked anywhere it was common, nor worked on a team where anyone else signed commits. I don't know how it's really used in the wild, so to speak.
  - danielheath 2mo ago
    > I don't know how it's really used in the wild, so to speak. Commit signing primarily exists because linux kernel development happens via email, which isn't a secure channel. In that context, signing is used to prove provenance; a commit signed by someone with merge rights gets included, and if you repeatedly sign bad code you'll have your right to merge revoked. > you can hold me accountable for that commit I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it.
    - samhclark 2mo ago
      Makes sense, thanks for that context. I knew that linux kernel dev happens over email, but didn't piece that together with commit signing. > I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it. I think that's reasonable. I'd say that if I push the commit, then I should be accountable for it whether I read it or not (and no one is going to see it unless I push it).

danielheath 2mo ago

... you're getting the agent to sign commits for you without manual intervention?

samhclark 2mo ago
Yeah. The agent can create commits and those commits are signed (`commit.gpgsign true`). I'm treating it like...you can hold me accountable for that commit and the commit came from my computer. That feels like the right spirit of things. How do you do commit signing? I've never worked anywhere it was common, nor worked on a team where anyone else signed commits. I don't know how it's really used in the wild, so to speak.
- danielheath 2mo ago
  > I don't know how it's really used in the wild, so to speak. Commit signing primarily exists because linux kernel development happens via email, which isn't a secure channel. In that context, signing is used to prove provenance; a commit signed by someone with merge rights gets included, and if you repeatedly sign bad code you'll have your right to merge revoked. > you can hold me accountable for that commit I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it.
  - samhclark 2mo ago
    Makes sense, thanks for that context. I knew that linux kernel dev happens over email, but didn't piece that together with commit signing. > I wouldn't personally want to be held accountable for a commit I'd never so much as read, so I would never sign (even locally) a commit until I'd looked at it. I think that's reasonable. I'd say that if I push the commit, then I should be accountable for it whether I read it or not (and no one is going to see it unless I push it).