Kernel.org Transparency Log Monitor

This webpage is a monitor of the kernel.org transparency log for git-receive operations. This service scans the transparency log every 60 minutes and attempts to validate the attached signatures. The goal is to ensure all code pushes to kernel.org repositories can be traced back to some operation on the transparency log.

This ensures server compromises where an malicious actor with direct access to the git repository can't insert commits without it being apparent through a missing push operation on the log. Attacks similar to the attempted PHP backdoor gets harder to successfully accomplish as a result.

• https://korg.docs.kernel.org/gitolite/transparency-log.html
• https://arstechnica.com/gadgets/2021/03/hackers-backdoor-php-source-code-after-breaching-internal-git-server/

Please note that not all operations are signed and the service is still a work in progress. Any invalid signatures are most likely the fault of the operator :)
Code can be found on https://github.com/Foxboron/kernel.org-git-verifier