Add support for SSH-signed commits

docs/generated-module-options.md

@@ -889,6 +889,27 @@ signed integer
 
 
 
+## services\.comin\.sshAllowedSignersPath
+
+
+
+An OpenSSH allowed signers file path used to verify SSH-signed Git commits\.
+
+
+
+*Type:*
+null or string
+
+
+
+*Default:*
+
+```nix
+null
+```
+
+
+
 ## services\.comin\.submodules
 
 
@@ -932,5 +953,3 @@ null or string
 ```nix
 null
 ```
-
-

docs/howtos.md

@@ -65,11 +65,23 @@ configuration to the new machine.
 ## Check Git commit signatures
 
 The option `services.comin.gpgPublicKeyPaths` allows to declare a list
-of GPG public keys. If `services.comin.gpgPublicKeyPaths != []`, comin **only** evaluates commits signed
-by one of these GPG keys. Note only the last commit needs to be signed.
+of GPG public keys. If `services.comin.gpgPublicKeyPaths != []` or
+`services.comin.sshAllowedSignersPath` is set, comin only evaluates commits
+signed by a configured commit-signing trust source. Note only the last commit
+needs to be signed.
 
 The file containing a GPG public key has to be created with `gpg --armor  --export alice@cyb.org`.
 
+The option `services.comin.sshAllowedSignersPath` can also be used to verify
+SSH-signed commits with an OpenSSH allowed signers file. For example:
+
+```text
+alice@example.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...
+```
+
+comin supports public key entries and the optional `namespaces=` restriction;
+other allowed signers options are rejected.
+
 
 ## How to deploy a nix-darwin configuration
 

go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.9.0
+	golang.org/x/crypto v0.39.0
 	google.golang.org/grpc v1.75.0
 	google.golang.org/protobuf v1.36.9
 	gopkg.in/yaml.v2 v2.4.0
@@ -77,7 +78,6 @@ require (
 	github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/crypto v0.39.0 // indirect
 	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.41.0 // indirect

internal/config/config.go

@@ -78,10 +78,11 @@ func Read(path string) (config types.Configuration, err error) {
 
 func MkGitConfig(config types.Configuration) types.GitConfig {
 	return types.GitConfig{
-		Path:              filepath.Join(config.StateDir, "repository"),
-		Dir:               config.RepositorySubdir,
-		Remotes:           config.Remotes,
-		GpgPublicKeyPaths: config.GpgPublicKeyPaths,
-		Submodules:        config.Submodules,
+		Path:                  filepath.Join(config.StateDir, "repository"),
+		Dir:                   config.RepositorySubdir,
+		Remotes:               config.Remotes,
+		GpgPublicKeyPaths:     config.GpgPublicKeyPaths,
+		SshAllowedSignersPath: config.SshAllowedSignersPath,
+		Submodules:            config.Submodules,
 	}
 }