Back to course

Securing the Supply Chain with GPG

Modern DevSecOps (The Hard Way)

Verifying Code Identity

Supply chain attacks often involve impersonating developers. GPG (GNU Privacy Guard) allows you to sign your Git commits.

Steps:

  1. Generate GPG Key: gpg --full-generate-key.
  2. Add public key to GitHub/GitLab.
  3. Configure Git to sign commits: git config --global commit.gpgsign true.

Now, every commit has a 'Verified' badge, proving it came from you.