Who in the World is Carmen Sandiego?

Joris Kraak, Senior Software Engineer

Identity

in

Distributed Version Control Systems

Bazaar Git Mercurial

How do we identify actors in history?

A Piece of History

Origin of Identity


              $ git config user.name
              Joris Kraak
              $ git config user.email
              jkraak@gnresound.com
            

Not Guaranteed to be Truthful

A Possible Solution

Store public keys with canonical repository

Verify all commits are made by verified authors on publication

How To Get Started

Get a GPG key

gpg --full-generate-key

How To Get Started


              $ keybase pgp export --secret > keybase.key
              # Asks for original passphrase and new passphrase for key

              $ gpg --allow-secret-key-import --import keybase.key
              # Asks for new key
              $ rm keybase.key

              $ gpg --edit-key <your_handle>@keybase.io adduid trust save
              # Provide real name, work email and (optionally a) comment
              # Confirm 'Ultimate Trust' by selecting 5 and y

              $ gpg --armor --export <your_handle>@gnresound.com
              # Upload output to relevant repository host (and Keybase)

              $ git config --global commit.gpgsign true
            

Thank You!

For questions, contact me at bauglir on Keybase

or shoot me an e-mail

Credits

Bazaar Logo
Canonical Ltd. (GPL)
Carmen Sandiego
Netflix, Inc.
GnuPG Logo
GnuPG (GPL)
Git Logo
Jason Long (CC-BY-3.0)
Keybase Logo
Keybase (BSD-3-Clause)
Mercurial Logo
Matt Mackal (GPL v2+)
Ted
Universal Pictures
Where in Time is Carmen Sandiego?
The Learning Company/Houghton Mifflin Harcourt