Security

For every product that we work on, be it an internal project or a client project, we always use code version control.

Git Global Config & SSH Key Setup

We need to setup the global git config with the Minnek Workspace email:

• git config --global user.name "Your Name"
• git config --global user.email [email protected]
• git config --global core.editor "code --wait" optional to use VS Code as default editor
• git config --global core.autocrlf true on Windows
• git config --global core.autocrlf input on Linux/Mac

And all the connections to the repositories need to be with SSH, not with HTTP:

• Check if you have a existing SSH key Checking for existing SSH keys
• Generate a new SSH key with the Minnek workspace email: Generating a new SSH key and adding it to the ssh-agent

ssh-keygen -t rsa -b 4096 -C "[email protected]"

• Now you are ready to Adding a new SSH key to your GitHub account
• Validate your SSH connection: Testing your SSH connection

ssh -T [email protected]

GPG Key Setup

The main focus to use a signature in the project commits is to be confident about the source. We can validate the trust of any computer used in the office.

GitHub can extend this explanation About commit signature verification .

Requirements

• Git
• GPG tools to generate the key
• All the generated keys need to be under the minnekdigial.com domain email.
• Use this repository to test your GPG key.

1. Generate a new GPG Key

There are multiple ways to generate a GPG. GitHub has a guide for Git users:

• Generating a new GPG key
• Adding a GPG key to your GitHub account

2. Add the new Generated key to the GitHub

Now you can add the generated key to your GitHub account:

• Adding a GPG key to your GitHub account

3. Add the key to Git

We need to setup the generated key to the global Git config:

• Telling Git about your signing key

4. Sign the commits and tags before push

Don't forget to setup the gpgsign git config --global commit.gpgsign true, this will tell git to sign the commits by default:

• Signing commits
• Signing tags

Verify your Commits

Add a file yourname.txt to the reposiory mention above with the content You can trust in these changes.