2
=============================
4
Reasons to Sign Your Repository
5
--------------------------------
7
Bazaar can sign revisions using GnuPG, a Free Software implementation of the
8
OpenPGP digital signature format. By signing commits a person wanting to
9
make use of a branch can be confident where the code came from, assuming the
10
GnuPG keys used can be verified. This could for example prevent worry about
11
compromised code in the case where a server hosting Bazaar branches has been
12
hacked into. It could also be used to verify that all code is written by a
13
select group of people, such as if contributor agreements are needed.
15
Signatures are passed around with commits during branch, push, merge and other
21
There are many guides to creating a digital signature key with GnuPG. See
22
for example the `GnuPG Handbook
23
<http://www.gnupg.org/gph/en/manual.html#AEN26>`_ or the `Launchpad Wiki
24
<https://help.launchpad.net/YourAccount/ImportingYourPGPKey>`_.
30
To sign commits as they are made turn on the ``create_signatures``
31
configuration option in your ``bazaar.conf`` or ``locations.conf`` file::
33
create_signatures = always
35
When you next make a commit it will ask for the pass phrase for your GnuPG key.
36
If you want GnuPG to remember your password ensure you have ``gnupg-agent``
39
To sign previous commits to a branch use ``sign-my-commits``. This will go
40
through all revisions in the branch and sign any which match your
41
commit name. You can also pass the name of a contributor to ``sign-my-commits``
42
to sign someone else's commits or if your GnuPG key does not match your Bazaar
45
bzr sign-my-commits . "Amy Pond <amy@example.com>"
47
It will not sign commits which already have a signature.
49
To sign a single commit or a range of commits use the (hidden) command
54
``re-sign`` is also useful to change an existing signature.
59
Unfortunately there is currently no command for verifying signatures. This can
60
be done manually using bzrlib and Python::
62
>>> from bzrlib.branch import Branch
63
>>> b = Branch.open('/home/amy/src/daleks')
65
'amy@example.com-20110527185938-hluafawphszb8dl1'
66
>>> print b.repository.get_signature_text(b.last_revision())
67
-----BEGIN PGP SIGNED MESSAGE-----
70
bazaar-ng testament short form 1
71
revision-id: amy@example.com-20110527185938-hluafawphszb8dl1
72
sha1: 6411f9bdf6571200357140c9ce7c0f50106ac9a4
73
-----BEGIN PGP SIGNATURE-----
74
Version: GnuPG v1.4.11 (GNU/Linux)
76
iEYEARECAAYFAk32HFcACgkQpQbm1N1NUIiBXACg6ILsyvJp4+Twq190qk1I4v9K
77
PAAAoI8pg9s7uuqldqOwz6/uwH3ezdSX
79
-----END PGP SIGNATURE-----
81
The signature can be saved to a file and verified with ``gpg --verify
84
The signed SHA1 checksum is made from the ``bzr testament --long`` command
85
which includes information on the committer and a list of all files in that
86
commit along with their checksums. So if the signature is valid you can be
87
sure you are looking at the same code as the person who made the signature.
92
There is still a number of digital signature related features which are hoped
93
to be added to Bazaar soon. These include easy verificiation, qbzr
94
integration, signing with different keys and setting branches to require
added
removed
doc/en/user-guide/gpg_signatures.txt
