🪝 The Automation Imperative
Security and legal compliance systems fail when they depend on human memory. If developers must remember to run a manual verification command before every release or commit, sooner or later an unanchored commit reaches production.
GitProof solves this by integrating directly into Git's native hook lifecycle. With a single command:
# Install automated pre-push and pre-commit hooks in current repository gproof hook install # Output: ✅ Installed GitProof pre-push hook: .git/hooks/pre-push ✅ Hook configured: automatically seals Merkle proof before git push
⚙️ Hook Lifecycle & Execution Flow
When you run git push origin main, Git halts the push and delegates control to .git/hooks/pre-push:
- HEAD Detection: The hook determines the exact commit object ID being pushed.
- Working Tree Audit: Verifies working directory status. Uncommitted modifications trigger a prompt to ensure only clean code is certified.
- Merkle DAG Computation: Computes the SHA-256 Merkle root across all repository files.
- Seals `proof.json`: Writes the sealed cryptographic envelope directly into
.gitproof/proof.json. - Optional TSA Notarization: If configured, reaches DigiCert or Sectigo to attach an RFC 3161 atomic timestamp token.
- Push Continues: The hook exits
0, and Git transmits your authenticated commits to GitHub, GitLab, or your self-hosted remote.
GitProof respects your existing repository setup. If you already have a pre-push script (e.g. for linting or test runners), GitProof non-destructively chains its execution rather than overwriting your custom script.
🔬 Inspecting and Removing Hooks
You can check the health of your installed hooks or remove them at any time:
# Check hook status and verification flags gproof hook status # Remove GitProof hooks cleanly without touching other hooks gproof hook remove
🚀 CI/CD Pipeline Enforcement
Teams using GitHub Actions or GitLab CI can enforce that no pull request is merged unless its Merkle DAG proof and author signature are cryptographically valid:
name: Verify Cryptographic Authorship on: [push, pull_request] jobs: gitproof-check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Install GitProof run: curl -fsSL https://gitproof.legendrail.com/install.sh | bash - name: Verify Repository Attestation run: gproof verify