Introduction

If you’re new to signed commits, then read our article on why you should sign commits.

Note that not all Git platform support signed commits., and each platform may enforce different requirements for the types of key you can use to sign commits. For more information see our summary of common Git platforms and their support for signed commits.

MettleCI Workbench installs with signed commit capability disabled by default. You need to enable this functionality using a configuration file change which is described below.

Enable Git Signing for your Workbench instance

Git commit signing is enabled (or disabled) for your entire MettleCI Workbench instance, after which it is made available to those Workbench users who configure their Workbench user profiles appropriately. To enable Git commit signing in your Workbench instance set commitSigningEnabled to true in your config.yml file. See the the gitAuthentication section in MettleCI Workbench Configuration Files Explained for an example of how to do this.

Configuring this option (and restarting your Workbench service) will enable all Git commits to be signed by those users who have uploaded a private key to their MettleCI user profile (described below). Users who have not uploaded a private key to their Workbench user profile will continue to be able to commit to their authorised repositories, however their commits will remain unsigned until they provide Workbench with an appropriate key.

Configure your User Profile appropriately

Each user who wishes to sign their commits will need to add a relevant SSH key to their Workbench User profile:

1. Create an SSH key pair at command line (guide here)

   1. This should be a user-specific key (i.e. not shared with other team members)

   2. Check with your Git platform’s documentation for the type of keys which are compatible with it.

2. Upload the private key to your MettleCI Workbench profile

   1. Click your avatar or user name in the top right-hand corner of the Workbench interface and select Profile.

   2. The Git Signing Key heading will have a NOT SUPPLIED label next to it if you have not already supplied a key value. Select the Upload Key checkbox, paste your private SSH key into the text field and click Update Profile.

      

   3. When you upload your key to Workbench it encrypts it (using your DataStage password) and stores it safely in a Java key store - the same method used to support accessing Workbench using HTTPS. Once accepted the Git Signing Key heading will have a SUPPLIED label next to it.

      

3. Upload the public key associated with your private SSH key to your account on your Git platform. See your Git platform’s instructions on how to achieve this.

4. Try performing a commit from MettleCI Workbench and check your Git platform to see if it’s recognised as a signed commit.

   1. Note that not all Git platforms have a visual indicator of a commit being signed. See your Git platform’s instructions on how to verify that a commit has been signed.

      

5. You can delete your private SSH key at any time by selecting the Delete Key checkbox and clicking the Delete Key button.

   

When your DataStage Password Changes

When your DataStage password changes your SSH key will need to be re-encrypted by Workbench using this new password. To do this a user will need to re-upload their original private SSH key to Workbench. If they choose to use a new private SSH key with Workbench you’ll also need to upload the new public key to their Git platform.

Until they re-uploaded their private SSH key to Workbench, any user whose DataStage password has changed will be presented with the following error during Workbench Commit operations:

Cannot retrieve git signing key because your DataStage password has changed. Please re-upload your signing key and try again.