Add SSH signature verification for git commits#1141

Merged

stefanprodan merged 32 commits into

fluxcd:mainfrom

bb-Ricardo:rb-feature/adds-ssh-signature-validation

Jun 2, 2026

Commits on Jun 2, 2026

adds SSH signature validation for git commits
bb-Ricardo
committed
adds validation of key fingerprint string
bb-Ricardo
committed
adds better git signature detection format
bb-Ricardo
committed
adds detection for added signature prefixes
bb-Ricardo
committed
adds tests for git.go
bb-Ricardo
committed
adds requested changes regarding naming
bb-Ricardo
committed
cleans up tests and removed duplicate test files
bb-Ricardo
committed
fixes text fixtures public key names
bb-Ricardo
committed
adds 'SignatureTypeEmpty' check and improves description of 'GetSignatureType'
bb-Ricardo
committed
Update git/signatures/testdata/gpg_signatures/generate_gpg_fixtures.sh

bb-Ricardo
and
pjbgf
committed
removes insecure DSA keys from signature test
bb-Ricardo
committed
updates git go.mod dependencies
bb-Ricardo
committed
fixes tests for unsigned tags
bb-Ricardo
committed
renames package to signature and fixes requested changes
bb-Ricardo
committed
switches signarture type from public to private
bb-Ricardo
committed
moves buildTag and buildCommitWithRef to internal/build package
bb-Ricardo
committed
improves signature validation to test all provided keys/keyrings if malfored key is included
bb-Ricardo
committed
removes gnupg ed448 generated key test fixtures and adds mention to README
bb-Ricardo
committed
removes verfied signers from ssh signature test fixtures
bb-Ricardo
committed
updates test fixtures generation scripts and regenerated test fixtures
bb-Ricardo
committed
fixes text fixtures creation description and adds test for unsigned commits and tags
bb-Ricardo
committed
adds more test for malfromed signatures
bb-Ricardo
committed
renames VerifyGPG to VerifyPGP
bb-Ricardo
committed
git: fix multi-keyring verify fall-through

hiddeco
authored and
bb-Ricardo
committed
git: add sentinel errors for signature verify

hiddeco
authored and
bb-Ricardo
committed
git: drop PGP MESSAGE armor from detection

hiddeco
authored and
bb-Ricardo
committed
git: correct godoc on signature verify API

hiddeco
authored and
bb-Ricardo
committed
git: unexport signature prefix slice vars

hiddeco
authored and
bb-Ricardo
committed
git: move test helpers to internal/testutil

hiddeco
authored and
bb-Ricardo
committed
git: cover more signature verification cases

hiddeco
authored and
bb-Ricardo
committed
git: stage fixture scripts via mktemp swap

hiddeco
authored and
bb-Ricardo
committed
git: fixes issue with order of imports
bb-Ricardo
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SSH signature verification for git commits#1141

Add SSH signature verification for git commits#1141
stefanprodan merged 32 commits into
fluxcd:mainfrom
bb-Ricardo:rb-feature/adds-ssh-signature-validation

Commits on Jun 2, 2026

adds SSH signature validation for git commits

adds validation of key fingerprint string

adds better git signature detection format

adds detection for added signature prefixes

adds tests for git.go

adds requested changes regarding naming

cleans up tests and removed duplicate test files

fixes text fixtures public key names

adds 'SignatureTypeEmpty' check and improves description of 'GetSignatureType'

Update git/signatures/testdata/gpg_signatures/generate_gpg_fixtures.sh

removes insecure DSA keys from signature test

updates git go.mod dependencies

fixes tests for unsigned tags

renames package to signature and fixes requested changes

switches signarture type from public to private

moves buildTag and buildCommitWithRef to internal/build package

improves signature validation to test all provided keys/keyrings if malfored key is included

removes gnupg ed448 generated key test fixtures and adds mention to README

removes verfied signers from ssh signature test fixtures

updates test fixtures generation scripts and regenerated test fixtures

fixes text fixtures creation description and adds test for unsigned commits and tags

adds more test for malfromed signatures

renames VerifyGPG to VerifyPGP

git: fix multi-keyring verify fall-through

git: add sentinel errors for signature verify

git: drop PGP MESSAGE armor from detection

git: correct godoc on signature verify API

git: unexport signature prefix slice vars

git: move test helpers to internal/testutil

git: cover more signature verification cases

git: stage fixture scripts via mktemp swap

git: fixes issue with order of imports