Create a Git Signing Connector

A Git Signing Connector lets Code Sign Manager upload users' GPG public keys to GitLab automatically. When you assign the connector to a per-user GPG Environment Template, each user's GPG signing key is uploaded to their GitLab account. GitLab then shows the commits they sign with that key as Verified.

Before you begin

  • You must be a Code Signing Administrator.
  • Have a GitLab personal access token (PAT) ready. The token must belong to a GitLab administrator. See Preparing GitLab for GPG key provisioning for the recommended permissions and expiration.
  • Make sure the Trust Protection Foundation servers can reach GitLab over HTTPS. The servers must trust GitLab's TLS certificate, and must be able to reach the certificate's revocation list (CRL).

To create a Git Signing Connector

  1. In Trust Protection Foundation Configuration Console, expand the Code Sign node, and then click Git Signing Connectors.
  2. In the Actions panel, click Add GitLab Signing Connector.
  3. Enter a name for the connector, and then click Create. This is the name you'll select when you assign the connector to an Environment Template.

    The connector's properties dialog opens to the GitLab Git Signing Connector tab.

  4. In GitLab Host URL, enter the HTTPS address of your GitLab server, such as https://gitlab.example.com.

    NOTE  Enter only the protocol and host name. Anything after the host name is removed when you save, so GitLab servers that run under a sub-path (for example, https://example.com/gitlab) aren't supported.

  5. Click the Credential DN drop-down list to create or select the credential that holds the GitLab PAT. For existing credentials, only Password credentials are listed.

    1. In the location browser, expand Policy, and then select the folder where you want to create the credential.
    2. Click Create. If you select a credential instead of a folder, this button changes to Select.
    3. Enter an Object Name that helps you identify this credential. Optionally, select a Contact and enter a Description. Click Create.

    4. In the GitLab PAT field, enter the GitLab personal access token. Optionally, update the Description and Contact.

    5. Click Save.

    CAUTION  The credential is created as soon as you click Create in step 3, before you enter the token. If you cancel before clicking Save, an incomplete credential is left in the Policy tree. Delete it, or select it later and enter the token. A connector that uses an incomplete credential can't be saved.

    1. In the location browser, expand Policy, and then select the Password credential that holds the GitLab PAT.
    2. Click Select. The credential's GitLab PAT panel appears.
    3. To keep the current token, click Save without changing anything. To replace the token, enter the new token in GitLab PAT, and then click Save.

  6. Click OK.

    Trust Protection Foundation tests the connection before it saves the connector. It connects to GitLab with the token and confirms that the token belongs to a GitLab administrator. If the test fails, the connector isn't saved and an Error Saving Connector Settings message appears. If GitLab can't be reached, the test can take a minute or more before the message appears. See If the connector can't be saved.

Next, assign the connector to a per-user GPG Environment Template. Open the template's properties, and on the Settings tab, select the connector from the Git Connector list. See Create Environment Templates.

Edit or delete a Git Signing Connector

To change a connector's GitLab address or credential, select the connector in the Git Signing Connectors node, and then click Properties in the Actions panel. The connection is tested again when you click OK or Apply.

To delete a connector, select it, and then click Delete in the Actions panel.

If the connector can't be saved

The error message starts with Failed verifying access: GitLabSigningDriver.Initialize:, followed by one of the messages in this table.

Message

What to check

Web Service URL format unexpected (https://gitlab.example.com only)

The GitLab Host URL must start with https://.

missing required Web Service URL attribute
Web Service URL too short

Enter the full GitLab Host URL.

missing required Credential attribute
failed to resolve Credential DN
failed to parse Credential DN

Select a Credential DN. Make sure the credential still exists and that its GitLab PAT field isn't empty.

Service is not reachable

The Trust Protection Foundation server couldn't complete an HTTPS request to GitLab. The test runs from the Trust Protection Foundation server, not from the computer running the console. Common causes:

  • The host name is wrong, or the server isn't GitLab.
  • A firewall or proxy blocks port 443 from the Trust Protection Foundation server.
  • The server doesn't trust GitLab's TLS certificate. Install the issuing CA chain in the server's Local Machine certificate store.
  • The server can't reach the CRL for GitLab's certificate. Revocation checking is required.

Token is unauthorized

GitLab rejected the token. It might be mistyped, expired, or revoked. Create a new token and update the credential. See Rotate the token.

User is not an admin

The token belongs to a GitLab user who isn't an administrator. Create the token from a GitLab administrator account.

Failed to validate token
No user found

GitLab returned an unexpected response. Check that the URL points to GitLab and that the token is valid.