Git commit and tag signing

Multiple maintainers jointly sign git commits and tags on protected branches. No single maintainer can ship a backdoor.

How it works

The threshold quorum signs the canonical commit object (the same text git signs with git commit -S). The signature wraps in git’s gpgsig format.

Quickstart

# 2-of-3 maintainer quorum signs the commit.
sig = Confium::TC::Cmp20.sign(two_shares, 2, commit_object_text)
# sig is a standard 64-byte ECDSA-P256 signature.
# Wrap in git's gpgsig format and attach to the commit.

See the full runnable example at examples/git_signing.rb.