{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/paas-cf/issues/222","repository_url":"https://api.github.com/repos/alphagov/paas-cf","labels_url":"https://api.github.com/repos/alphagov/paas-cf/issues/222/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/paas-cf/issues/222/comments","events_url":"https://api.github.com/repos/alphagov/paas-cf/issues/222/events","html_url":"https://github.com/alphagov/paas-cf/pull/222","id":150420752,"number":222,"title":"[#117704989] Verification of Code for Production","user":{"login":"mtekel","id":483891,"avatar_url":"https://avatars.githubusercontent.com/u/483891?v=3","gravatar_id":"","url":"https://api.github.com/users/mtekel","html_url":"https://github.com/mtekel","followers_url":"https://api.github.com/users/mtekel/followers","following_url":"https://api.github.com/users/mtekel/following{/other_user}","gists_url":"https://api.github.com/users/mtekel/gists{/gist_id}","starred_url":"https://api.github.com/users/mtekel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtekel/subscriptions","organizations_url":"https://api.github.com/users/mtekel/orgs","repos_url":"https://api.github.com/users/mtekel/repos","events_url":"https://api.github.com/users/mtekel/events{/privacy}","received_events_url":"https://api.github.com/users/mtekel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-04-22T16:55:34Z","updated_at":"2016-04-26T15:07:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/alphagov/paas-cf/pulls/222","html_url":"https://github.com/alphagov/paas-cf/pull/222","diff_url":"https://github.com/alphagov/paas-cf/pull/222.diff","patch_url":"https://github.com/alphagov/paas-cf/pull/222.patch"},"body":"## What\r\n\r\n[Verification of Code for Production](https://www.pivotaltracker.com/n/projects/1275640/stories/117704989)\r\n\r\nUse git resource from https://github.com/alphagov/paas-git-resource/pull/1 and start verifying commits. This includes modification of concourses (bootstrap & deployer) to use new resource, modification of pipelines, pipeline deploy scripts and adding a list of trusted commiters (which is the 1st signed commit). \r\n\r\n**Note**: You can add your own GPG key (the one you use to sign the commits) to github. It will then display 'Verified' on the commits that match - see the team gpg IDs adding commit in this PR.\r\n\r\nWe also enable caching for deployer concourse - which is not a separate PR in order to save one further re-deployment of the deployer (in each environment).\r\n\r\n## How to review\r\n\r\nDeploy or apply against existing environment. If https://github.com/alphagov/paas-git-resource/pull/1 is not merged before review, you need to configure concourses to use the resource from the branch:\r\n* in concourse-base.yml\r\n```\r\n-          - { type: git-gpg, image: \"docker:///governmentpaas/git-resource\" }\r\n+          - { type: git-gpg, image: \"docker:///governmentpaas/git-resource#signed_commits\" }\r\n```\r\n* in 30-add-custom-resources.py\r\n```\r\n-        { \"type\": \"git-gpg\", \"image\": \"docker:///governmentpaas/git-resource\" }\r\n+        { \"type\": \"git-gpg\", \"image\": \"docker:///governmentpaas/git-resource#signed_commits\" }\r\n```\r\n\r\nYou can also test adding unsigned commit and see paas-cf resource fail. Then you can disable commit verification using `VERIFY_COMMITS` env. variable. Note that you'd also need to disable pipeline self updating:\r\n`VERIFY_COMMITS=false SELF_UPDATE_PIPELINE=true make dev pipelines`\r\n\r\n## Who can review\r\n\r\nNot @mtekel or @saliceti "},"comment":{"url":"https://api.github.com/repos/alphagov/paas-cf/issues/comments/214776388","html_url":"https://github.com/alphagov/paas-cf/pull/222#issuecomment-214776388","issue_url":"https://api.github.com/repos/alphagov/paas-cf/issues/222","id":214776388,"user":{"login":"mtekel","id":483891,"avatar_url":"https://avatars.githubusercontent.com/u/483891?v=3","gravatar_id":"","url":"https://api.github.com/users/mtekel","html_url":"https://github.com/mtekel","followers_url":"https://api.github.com/users/mtekel/followers","following_url":"https://api.github.com/users/mtekel/following{/other_user}","gists_url":"https://api.github.com/users/mtekel/gists{/gist_id}","starred_url":"https://api.github.com/users/mtekel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtekel/subscriptions","organizations_url":"https://api.github.com/users/mtekel/orgs","repos_url":"https://api.github.com/users/mtekel/repos","events_url":"https://api.github.com/users/mtekel/events{/privacy}","received_events_url":"https://api.github.com/users/mtekel/received_events","type":"User","site_admin":false},"created_at":"2016-04-26T15:07:07Z","updated_at":"2016-04-26T15:07:07Z","body":"Updated commit message. I also added 2 commits to readme, describing use of VERIFY_COMMITS and SELF_UPDATE_PIPELINE environment variables."}}