Publishing GPG keys to GitLab automatically

When developers sign Git commits with GPG keys managed by Code Sign Manager, GitLab shows those commits as Verified only if the matching public key is in the developer's GitLab account. Instead of having each developer export and upload their public key, Code Sign Manager can upload it for them.

How it works

  1. An administrator creates a Git Signing Connector that connects Code Sign Manager to GitLab, and assigns it to a per-user GPG Environment Template.
  2. When a user's GPG signing key is created in an Environment that uses that template, Code Sign Manager finds the user's GitLab account by email address and uploads the public key to it. The same happens when the key is renewed.
  3. The upload status of each key appears on the Environment's Instances tab, where you can also upload failed keys again or revoke keys in GitLab. See Managing GitLab key uploads.
  4. GitLab shows commits signed with the key as Verified.

Users still need to configure Git on their own computers to sign commits with their key. See Signing git commits with GPG.

Setting up GitLab key provisioning

  1. Preparing GitLab for GPG key provisioning and create a personal access token.
  2. Create a Git Signing Connector.
  3. Assign the connector to a per-user GPG Environment Template. On the template's Settings tab, select the connector from the Git Connector list. See Create Environment Templates.

Limitations

  • Only GitLab is supported. GitLab.com isn't supported, because the connector requires a GitLab administrator account.
  • Only per-user GPG Environment Templates can use a Git Signing Connector, and each template can use one connector.
  • Only the GPG signing key is uploaded. Encryption and authentication keys aren't.
  • Keys that already exist when you assign a connector to a template aren't uploaded right away. They're uploaded when the key is renewed, or the next time the Trust Protection Foundation service restarts. Until then, they show Pending.
  • When a key is renewed, the new public key is uploaded, but the old key stays in GitLab. Deleting a key in Code Sign Manager doesn't remove it from GitLab.
  • Keys aren't revoked in GitLab automatically. To revoke a key in GitLab, use the Environment's Instances tab.