Skip to main content

Secure DevOps With Bitbucket

This article explains how to set up the Beyond Identity Authenticator to sign and verify code with Bitbucket using GPG keys, including configuring user entitlements, repository paths, CI/CD pipelines, and optional biometric verification to ensure secure commit signing and verification in the DevOps workflow.

This guide provides instructions on how to:

  • Set up the Beyond Identity (BI) Authenticator to sign and verify code with Bitbucket.

  • Use the Beyond Identity Authenticator with GPG key entitlements to sign and verify code based on typical DevOps events, such as push, pull, and merge. This ensures the security of the SDLC process, with signature validation triggered automatically as part of the CI/CD pipeline.

  • Generate a GPG key on the BI Authenticator, which can be used to sign multiple repositories; however, each repository can only be signed with one key.

  • Ensure that the email used for signing is enrolled in the Beyond Identity tenant.

  • Optionally require commits to be verified with biometrics, preventing local malware or developers from bypassing hygiene and security controls.

Secure DevOps is an add-on for Secure Workforce. Contact your Account Representative to add this feature to your environment.

Prerequisites

Bitbucket prerequisites

  • A configured source code repository, project, and entitled users to pull, commit, and merge source code.

  • (Optional) A configured CI/CD pipeline.

Beyond Identity prerequisites

  • A Beyond Identity tenant configured for your organization and the ability to enroll users.

  • An integration with your SSO provider. The instructions are different based on your SSO provider. Please refer to the integration guides available in the link below:
    https://supportcases.beyondidentity.com/hc/en-us/sections/6746815209111-Integration-Guides

  • Any users who will sign the code must

    • Have a copy of the Beyond Identity authenticator installed.

    • Have enrolled a passkey with the tenant using the same email that will be used to sign the code.

Note the following:

  • A Beyond Identity authenticator with GPG key entitlements can sign and verify code based on typical DevOps events like push, pull, etc. This is a powerful tool to ensure the security of the SDLC process. The event triggers the signature validation process as part of the CI/CD pipeline.

  • A GPG key generated on the Beyond Identity Authenticator can be used to sign many repositories, but a repository can be signed with only one key.

Configure Beyond Identity for Bitbucket

  • Generate a Key management token

  • Get an authenticator entitlement to generate GPG keys

  • Generate a GPG Key

  • Set a repository path on the authenticator

Generate a Key management token

Your Beyond Identity Representative will provide you with a key management token. This token will be used in the CI/CD pipeline as the value of BYNDID_KEY_MGMT_API_TOKEN in later steps.

Get an authenticator entitlement to generate GPG keys

A Beyond Identity SME will enable the following entitlements for your tenant in the Support console so users can begin using their authenticator for commit signing.

  • Commit Signing - Enables users to generate GPG keys and configure repository paths. Signs and verifies the author of every commit using the authenticator to prevent unauthorized threats.

  • Commit Signing with Biometrics (optional) - Requires users to provide biometrics as part of signing and verifying commit signing to prevent local malware from committing code or developers from bypassing hygiene and security controls.

Add groups and users (BI Admin console)

Once the entitlements are enabled, add groups using the names in this section to generate GPG keys, configure repository paths, and optionally require biometrics for commit signing.

Important: You must use the exact group name provided below for SDO to work.

  1. Open the Groups page in the Admin console and click Add Group.

    1. Enter BI_SDO_GPG_Key_Creation for the group name.

      Important: You must use BI_SDO_GPG_Key_Creation as the exact name for Commit Signing to work.

    2. Enter an optional description and click Save Changes.

    3. Open the newly created group and then click Add Users to add any developers to this group.

  2. Users added in the steps above will see a GPG Keys link in their authenticator as shown below.

  3. Continue to the Generate a GPG Key and set a repository (Authenticator) section below for steps the development users will need to follow.

Generate a GPG Key and set a repository path (Authenticator)

  1. On the Beyond Identity platform authenticator, click the GPG Keys link.

  2. Click Create GPG key to create and configure GPG keys.

  3. Ensure the email address matches the email configured to perform Bitbucket operations. You can ignore the expiration date.

  4. Click Create. You should see the key in the Authenticator.

  5. Set the repository path on the authenticator.

    1. In the authenticator, click the ellipses to the right of the GPG key and choose Set repository.

    2. Browse to the local path of the repository root and click Configure.

    3. Continue to Configure Bitbucket below.

Configure Bitbucket

  1. Create a new account.

  2. Sign into Bitbucket with the account with the same email that will be used to code sign/verify

  3. Create a Project / Repository.

  4. Navigate to Your Repository > Settings > Repository Variables.

  5. Configure a Bitbucket variable for the BYNDID_KEY_MGMT_API_TOKEN with the value generated in Generate a Key management token.

  6. Configure the bitbucket-pipelines.yml file defines your Pipelines builds configuration:

pipelines:

branches:

master:

- step:

name: Commit Signature Verification

script:

- pipe: docker://byndid/auth-commit-sig:0.4.1-rc3-debian

variables:

API_TOKEN: $BYNDID_KEY_MGMT_API_TOKEN

  1. Clone the code to your local repository.

  2. Change the code as required.

  3. Commit with signing, similar to the following:
    git commit -v -S -m "Modified README commit with -S"

  4. (Optional) If biometrics were enabled for signing, you will be prompted to provide biometric verification to complete the signing.

  5. Push the code to Origin.

  6. Verify a successful pipeline run

    • Your Repository > Pipelines. The pipeline should display successfully.

Appendix: Get Started with Bitbucket

Bitbucket prerequisites

  • Create an account

    • Use the same email account that you will use to code sign/verify

  • Create a repository

  • Sign in with the same email account that you will use to code sign/verify

  • You should have privileges to clone, modify, commit changes.

Create an account

Create a repository

Starting using Bitbucket

Comments

0 comments

Please sign in to leave a comment.