diff --git a/README.md b/README.md index 17d8c30..51723f3 100644 --- a/README.md +++ b/README.md @@ -2,20 +2,6 @@ A tool to sign arbitrary objects in a git repository. -## Brief overview of how it works - -This tool writes a tree object to some git repository containing the -following blobs: - -``` -100644 blob aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa object -100644 blob bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb signature -``` - -Where `object` stores the raw (20 byte) object id of some git object -to be signed, and `signature` stores the signature over `object`. The -tree's hash is returned by `git signify sign`. - ## Generating keys Signing keys can be generated with [`signify`](https://man.openbsd.org/signify.1), @@ -28,18 +14,61 @@ $ signify -G -p newkey.pub -s newkey.sec If you do not wish to encrypt your keys, pass the `-n` flag to the command line of `signify`. -## Usage +## Basic usage + +This program keeps track of signatures made by a keypair with a given +fingerprint as git references. References can be fetched from and +pushed to a remote. + +``` +$ git signify pull origin +$ git signify push origin +``` + +Verification can be done with `git signify verify`. For example, to +verify a release of `git-signify` itself: + +``` +$ git pull --tags +$ git signify pull +$ git signify verify -k keys/releases.pub v0.3.0 +``` + +To sign git revisions, run something akin to: + +``` +$ git signify sign -k v0.3.0 +``` + +## In-depth + +### Brief overview of this program works + +`git-signify` writes a tree object to some git repository containing the +following blobs: + +``` +100644 blob aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa object +100644 blob bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb signature +``` + +Where `object` stores the raw (20 byte) object id of some git object +to be signed, and `signature` stores the signature over `object`. The +tree's hash is returned by `git signify sign`. + +### Storing signatures in tags -The flags supported by this program and their respective documentation can -be checked by running the following commands: +To store signatures in tags, one must use the "raw" mode of `git-signify`. +The raw flags supported by this program and their respective documentation +can be checked by running the following commands: ``` -$ git signify -h -$ git signify sign -h -$ git signify verify -h +$ git signify raw -h +$ git signify raw sign -h +$ git signify raw verify -h ``` -To push signatures to a remote, the suggested approach is the following: +The suggested approach to store signatures in tags is the following: ``` $ SIGNATURE_TREE=$(git signify sign -k $SECRET_KEY $OBJECT_TO_SIGN) @@ -51,5 +80,5 @@ $ git push --tags Verification can then be done with: ``` -$ git signify verify -p -k $PUBLIC_KEY $SIGNATURE_COMMIT^{tree} +$ git signify raw verify -p -k $PUBLIC_KEY $SIGNATURE_COMMIT^{tree} ```