Verification Process

Currently the repository’s security policy amounts to checking that the working tree satisfies gittuf policy. Ensure that gittuf is installed, that gpg signing for commits has been enabled, and that the repository has been cloned via:

gittuf clone https://github.com/daml-community/dpm-identity.git

NOTE: cloning via gittuf is important, as it pulls the correct git refs.

Listing the gittuf policy

Ensuring that you have followed the instructions above to install gittuf, gpg and clone the repo, the gittuf policy can be listed via running:

To list all principals

gittuf policy list-principals

To list all rules

gittuf policy list-rules

Verifying the gittuf policy

Ensuring that you have followed the instructions above to install gittuf, gpg and clone the repo, helper commands are provided to check that the repo satisfies gittuf policy. Run the following:

Linux/macOS

From Bash:

sh ./ci/verify.sh

Windows

From PowerShell:

.\ci\verify.ps1

A practical demo

The following demonstrates a user violating this policy by creating the files:

• identities/my-id/meta.json
• identities/my-id/my-fp/key.asc

without the changes being approved by two committee members. Ensuring that you have followed the instructions above to install gittuf, gpg and clone the repo, run the following:

# Checkout master
git checkout -B master 97443173add138eac6c1e0444bedb4a18d8e15f5

# Create a new identity my-id
mkdir -p identities/my-id/my-fp/
touch identities/my-id/meta.json
touch identities/my-id/my-fp/key.asc

# Commit these changes
git add .
git commit -m "Add my-id without committee approval"

# Record the changes to gittuf
gittuf rsl record master --local-only

# Verify that the repository policy is not satisfied
sh ci/verify.sh