feat: add asdf-gitsign

[spencergilbert]

Signed-off-by: Spencer Gilbert [email protected]

Summary

Added a plugin to manage gitsign a tool from sigstore used to sign Git commits with a valid OpenID Connect identity.

When I have the time I'm going to look at adding the rest of their CLI tools, hopefully being able to combine them into a similar "generic" plugin like the one for Hashicorp tools.

Checklist

• CI tests are green. If you are using GitHub, you might want to use the plugin_test action from asdf-actions
• asdf-plugins CI sanity checks are green on your PullRequest. Test locally with:

./test_plugin.sh --file plugins/<PLUGIN_FILE>

---

This commit was signed with gitsign! The commit signature can be inspected with:

git cat-file commit 23dcd77 | sed -n '/BEGIN/, /END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text
# PKCS7: 
# ...
#     cert:
#         cert_info: 
#           version: 2
#           serialNumber: 0x60995DCB1E17345A7FEDBA372A76FD6C5EACFEED
#           signature: 
#             algorithm: ecdsa-with-SHA384 (1.2.840.10045.4.3.3)
#             parameter: <ABSENT>
#           issuer: O=sigstore.dev, CN=sigstore-intermediate
# ...
# Certificate:
# ...
#         Issuer: O=sigstore.dev, CN=sigstore-intermediate
#         Validity
#             Not Before: Nov 19 15:07:43 2022 GMT
#             Not After : Nov 19 15:17:43 2022 GMT
# ...
#         X509v3 extensions:
#             X509v3 Key Usage: critical
#                 Digital Signature
#             X509v3 Extended Key Usage: 
#                 Code Signing
# ...
#             X509v3 Subject Alternative Name: critical
#                 email:[email protected]
# ...

or with gitsign installed:

git verify-commit 23dcd77
# tlog index: 7423856
# gitsign: Signature made using certificate ID 0x30d0622f051df1f7d421db900a377d02269b57de | CN=sigstore-intermediate,O=sigstore.dev
# gitsign: Good signature from [[email protected]]
# Validated Git signature: true
# Validated Rekor entry: true

Note: GitHub's UI marks these signed commits as unverified for the time being, the issue tracking progress on that can be found at sigstore/gitsign#40

[jthegedus]

thanks

[jthegedus]

Very interesting work from sigstore