bhouse

Yubikey + GPG + Github + Keybase

The following guide are steps that can be used to generate GPG keys on a YubiKey, use the gpg keys to sign github commits, and publish the public gpg key to Keybase.

Why is this a good idea?

1. Generating and storing GPG keys on a YubiKey allows the private key to be protected and ported between physical machines.
2. Signing git commits adds an extra layer of verification that code changes originated from an trusted source.
3. Using a YubiKey + touch-to-sign requires a physical presence to use the GPG signing key.
4. GitHub supports restricting commits to a repo to only those that are signed.
5. Putting a physical stamp on your code commits invokes a feeling of pride.

bhouse

mkdir vault_demo && cd vault_demo
wget https://releases.hashicorp.com/vault/0.5.2/vault_0.5.2_darwin_amd64.zip
unzip vault_0.5.2_darwin_amd64.zip
export PATH=$(pwd):$PATH
cat > vault.conf <<EOF
backend "file" {
  path = "file_backend"
}

listener "tcp" {

bhouse

#!/bin/bash -e

# Setup a Root CA in vault
# Generate and sign an Intermediate cert
#
# Requires:
# * A running vault server already initialzed and unsealed
# * Environment variable VAULT_TOKEN is set
# * vault cli (https://www.vaultproject.io)
# * httpie (https://github.com/jkbrzt/httpie)

bhouse

Make a directory to install CentOS 7.2.1511 in

[root@localhost ~]# mkdir /centos_chroot

Make a directory for the rpm database

[root@localhost ~]# mkdir -p /centos_chroot/var/lib/rpm

Create the RPM database

bhouse

Keybase proof

I hereby claim:

• I am bhouse on github.
• I am benhouse (https://keybase.io/benhouse) on keybase.
• I have a public key whose fingerprint is C615 8D5A 7F72 5F8F C921 0D2F 2C59 5D16 D54A ECCB

To claim this, I am signing this object:

bhouse

#!/usr/bin/env ruby

require 'aws-sdk'

ec2 = Aws::EC2::Client.new(region: 'us-west-1')

volumes = ec2.describe_volumes.volumes

volume_sizes = {}
volumes.each do |vol|

bhouse

Keybase proof

I hereby claim:

• I am bhouse on github.
• I am bhousezendesk (https://keybase.io/bhousezendesk) on keybase.
• I have a public key whose fingerprint is 8D97 8A17 8249 A29F 451D 7F0B 01C9 A9C7 2950 88DB

To claim this, I am signing this object:

bhouse

pkg_path = '/vagrant/hello_world.py'

# we use a trick here to make the configuration change with
# the contents of the file, for simplicity.  in a normal setting, packages would be
# versioned, and the version number would be changed in the configuration.
import hashlib
with open(pkg_path, 'rb') as f:
  pkg_checksum = hashlib.md5(f.read()).hexdigest()

# copy hello_world.py into the local sandbox

bhouse

bhouse@admin1:~$ diff -u push-warm-spare{,.new}
--- push-warm-spare	2014-12-03 18:02:14.894289218 +0000
+++ push-warm-spare.new	2014-12-03 18:01:07.985219963 +0000
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+#!/bin/sh -exv

 date

@@ -25,7 +25,7 @@

bhouse

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "test template for zdops workshop",

  "Parameters" : {
    "KeyName" : {
      "Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instance",
      "Type" : "String"
    }