Signing commits
On the template wizard look for Verify Commits

-
Now, you hit the Review button for a final look at the form inputs.

-
Everything checks out, click on the Create button.

-
The Golden Path Template (GPT) kicks into action, and in just a few seconds it sets up everything you need for your Quarkus application.

-
You click on the Open Component in Catalog link.

-
You find and click on the OpenShift Dev Spaces (VSCode) link.

-
You log in using your OpenShift credentials by clicking the Log in with OpenShift button.

-
Then, you choose the Single Sign-On option by clicking the rhsso button

-
You then enter your username and password as follows:
-
Username: {developer_cluster_rhdh_user}
-
Password: {developer_cluster_rhdh_user_password}
-
-
After inputting your credentials, you click the Sign in button.
-
You authorize OpenShift Dev Spaces to access your account by clicking the Allow selected permissions button.

-
Subsequently, you click Authorize to grant OpenShift Dev Spaces access to your GitLab account.

-
OpenShift Dev Spaces then begins creating your workspace, processing a Devfile containing all the configuration needed to set up your development environment.
-
OpenShift Dev Spaces then begins creating your workspace, just like before.
-
After waiting a few minutes for OpenShift Dev Spaces to finish setting up your workspace, you’re presented with your IDE.
-
You click the button Yes, I trust the authors.

-
"For the purpose of this demo, updating the documentation will be enough to trigger the new build pipeline"
-
You expand the docs folder and open the markdown file index.md.
-
At the document’s end, you add: "Build pipeline integrated with security tools."

-
You click on the Hamburger button (three horizontal bars) on the top left of your screen and select Terminal → New Terminal

-
Run the below command on the VS Code terminal to view the Gitsign global git config:
git config --global --list
You may need to allow paste functionality when prompted by the browser. |

-
To begin commiting your code to the repository, run the following command to add your changes to staging:
git add .
-
Run the next command to commit your changes:
git commit -m "Doc Update"
-
You will notice that you receive an error message that states error opening browser: exec: "xdg-open": executable file not found in $PATH. This is because our VS Code terminal is trying to open a browser window to obtain your credentials for signing but is unable to as it is running as a container.
-
However, Gitsign allows you to provide your signing credentials by copying and pasting the url it outputs into a separate browser window.
-
Copy and paste the url into a new browser tab/window and hit enter.

-
The browser will prompt you for your credentials. Enter devspaces username and password.

-
You will then be redirected to another page that will present a verification code. Copy this code into your clipboard.

-
Return to Dev Spaces and paste this code into the waiting prompt in the VS Code terminal and hit enter:
Enter verification code:
-
If successful, you should receive a successful commit message:
-
Push the code to the repository with the below command:
git push
The verify-commit will now pass

Setting up local VS Code on Mac
Install gitsign
brew tap sigstore/tap brew install gitsign
git clone repository to local machine
Run the following commands to set up gitsign on your local machine. For this example we’ve updated the global git config. You may prefer to apply these changes locally instead of globally.
$ git config --global user.email user1@demo.redhat.com
$ git config --global user.name user1
$ git config --global commit.gpgsign true
$ git config --global tag.gpgsign true
$ git config --global gpg.x509.program gitsign
$ git config --global gpg.format x509
$ git config --global gitsign.fulcio https://fulcio-server-trusted-artifact-signer.<openshift-apps-domain>
$ git config --global gitsign.issuer https://keycloak-rhsso.<openshift-apps-domain>/auth/realms/openshift
$ git config --global gitsign.rekor https://rekor-server-trusted-artifact-signer.<openshift-apps-domain>
$ git config --global gitsign.clientid trusted-artifact-signer
Make a code chage
git commit -S -am "signing from Mac"



