diff --git a/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits.png b/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits.png deleted file mode 100644 index e1d44f15f3ff97aca598c4996a4ca554881c207b..0000000000000000000000000000000000000000 Binary files a/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits.png and /dev/null differ diff --git a/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits_v17_4.png b/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits_v17_4.png new file mode 100644 index 0000000000000000000000000000000000000000..e1eed8cd26540f21618970fa485733245a290abf Binary files /dev/null and b/doc/user/project/repository/signed_commits/img/project_signed_and_unsigned_commits_v17_4.png differ diff --git a/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature.png b/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature.png deleted file mode 100644 index 763a677f94a057668febded6df7974384925567c..0000000000000000000000000000000000000000 Binary files a/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature.png and /dev/null differ diff --git a/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature_v17_4.png b/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature_v17_4.png new file mode 100644 index 0000000000000000000000000000000000000000..937259d908a08d162c6ca0e733af5a00a47c58fd Binary files /dev/null and b/doc/user/project/repository/signed_commits/img/project_signed_commit_unverified_signature_v17_4.png differ diff --git a/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature.png b/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature.png deleted file mode 100644 index 1b6fa3fc2e2fc58a24defe76786c0b8f53211b79..0000000000000000000000000000000000000000 Binary files a/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature.png and /dev/null differ diff --git a/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature_v17_4.png b/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature_v17_4.png new file mode 100644 index 0000000000000000000000000000000000000000..ed6d69794a00096238e2a0b84643ffc75dc352d3 Binary files /dev/null and b/doc/user/project/repository/signed_commits/img/project_signed_commit_verified_signature_v17_4.png differ diff --git a/doc/user/project/repository/signed_commits/index.md b/doc/user/project/repository/signed_commits/index.md index ac2a8dbe806c48a0f969ee375a1a399753b61eea..a76c714913f5d104574dd691ad635ddc1ca626eb 100644 --- a/doc/user/project/repository/signed_commits/index.md +++ b/doc/user/project/repository/signed_commits/index.md @@ -11,11 +11,11 @@ DETAILS: **Tier:** Free, Premium, Ultimate **Offering:** GitLab.com, Self-managed, GitLab Dedicated -When you add a cryptographic signature to your commit, you provide extra assurance that a commit -originated from you, rather than an impersonator. If GitLab can verify a commit -author's identity with a public GPG key, the commit is marked **Verified** in the -GitLab UI. You can then configure [push rules](../push_rules.md) -for your project to reject individual unsigned commits, or reject all +When you add a digital signature to your commit, you provide extra assurance that a commit +originated from you, rather than an impersonator. A digital signature is a cryptographic output +used to verify authenticity. If GitLab can verify a commit author's identity with a public [GPG key](gpg.md), +the commit is marked **Verified** in the GitLab UI. You can then configure +[push rules](../push_rules.md) for your project to reject individual unsigned commits, or reject all commits from unverified users. Sign commits with your: @@ -26,8 +26,7 @@ Sign commits with your: ## Verify commits -You can review commits for a merge request, or for an entire project, to confirm -they are signed. +To review commits for a merge request, or for an entire project, and verify they are signed: 1. On the left sidebar, select **Search or go to** and find your project. 1. To review commits: @@ -35,26 +34,28 @@ they are signed. - For a merge request: 1. Select **Code > Merge requests**, then select your merge request. 1. Select **Commits**. -1. Identify the commit you want to review. Signed commits show either a **Verified** - or **Unverified** badge, depending on the verification status of the signature. - Unsigned commits do not display a badge: +1. Identify the commit you want to review. Depending on the verification status of the signature, + signed commits display either a **Verified** or **Unverified** badge. -  +  -1. To display the signature details for a commit, select **Verified** to see + Unsigned commits do not display a badge. + +1. To display the signature details for a commit, select **Verified** or **Unverified** to see the fingerprint or key ID: -  +  -  +  You can also [use the Commits API](../../../../api/commits.md#get-signature-of-a-commit) to check a commit's signature. ### Verify commits made in the web UI -GitLab signs the commits created using the web UI using SSH. -To verify these commits locally, use the [Web Commits API](../../../../api/web_commits.md#get-public-signing-key) to get the GitLab public key for signing web commits. +GitLab uses SSH to sign commits created through the web UI. +To verify these commits locally, obtain the GitLab public key for signing web commits +using the [Web Commits API](../../../../api/web_commits.md#get-public-signing-key). ## Troubleshooting