{"thread":{"id":"31898","subject":"signing commits with openssl/PKCS#11","startedAt":"2012-10-22T13:38:04Z","lastAt":"2012-10-25T09:15:06Z","messageCount":5,"participants":["Mat Arge","Michael J Gruber","Brandon Casey"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"201691","messageId":"1392235.RizYqAYdkC@off17","threadId":"31898","inReplyTo":null,"subject":"signing commits with openssl/PKCS#11","fromName":"Mat Arge","fromEmail":"argemat1010@gmail.com","sentAt":"2012-10-22T13:38:04Z","receivedAt":"2012-10-22T13:38:04Z","isPatch":false,"sender":{"key":"argemat1010@gmail.com","avatar":null},"body":"Hy!\n\nI would like to sign each commit with a X.509 certificate and a private key \nstored on a PKCS#11 token. I assume that that should be possible somehow using \na hook which calls openssl. Does somebody know a working implementation of \nthis?\n\ncheers\nMat\n"},{"id":"201804","messageId":"5087B8E7.8010306@drmicha.warpmail.net","threadId":"31898","inReplyTo":"1392235.RizYqAYdkC@off17","subject":"Re: signing commits with openssl/PKCS#11","fromName":"Michael J Gruber","fromEmail":"git@drmicha.warpmail.net","sentAt":"2012-10-24T09:46:15Z","receivedAt":"2012-10-24T09:46:15Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Mat Arge venit, vidit, dixit 22.10.2012 15:38:\n> Hy!\n> \n> I would like to sign each commit with a X.509 certificate and a private key \n> stored on a PKCS#11 token. I assume that that should be possible somehow using \n> a hook which calls openssl. Does somebody know a working implementation of \n> this?\n> \n> cheers\n> Mat\n> \n\nIn principle, we have an almost pluggable architecture. See for example\nthe latter part of the 2nd post in\n\nhttp://article.gmane.org/gmane.comp.version-control.git/175127\n\nUnless you want to change git itself, you're probably better off storing\nyour non-gpg signatures in a note (or a self-created signed tag). To\nsign the commit rev, you could sign the output of \"git cat-file commit\nrev\" (or of \"git rev-parse rev\") and store that signature in a note that\ncommit. To verify, you verify the note against the commit.\n\nMichael\n"},{"id":"201864","messageId":"CA+sFfMdSc30xmzFrqbPFYigLkW9v_YSrnTBtumhZiU5TKiBxqQ@mail.gmail.com","threadId":"31898","inReplyTo":"1392235.RizYqAYdkC@off17","subject":"Re: signing commits with openssl/PKCS#11","fromName":"Brandon Casey","fromEmail":"drafnel@gmail.com","sentAt":"2012-10-25T08:02:33Z","receivedAt":"2012-10-25T08:02:33Z","isPatch":false,"sender":{"key":"drafnel@gmail.com","avatar":"https://avatars.githubusercontent.com/u/921167?v=4"},"body":"On Mon, Oct 22, 2012 at 6:38 AM, Mat Arge wrote:\n> Hy!\n>\n> I would like to sign each commit with a X.509 certificate and a private key\n> stored on a PKCS#11 token. I assume that that should be possible somehow using\n> a hook which calls openssl. Does somebody know a working implementation of\n> this?\n\nCreating signatures from an rsa key on a pkcs11 token should be\npossible, but gnupg doesn't support pkcs11 for philosophical reasons.\nYou need to use gnupg-pkcs11 which is maintained outside of the gnupg\ntree.\n\nOnce you configure gnupg-pkcs11-scd, you'll be able to use git and gpg\nto sign tags as usual.\n\nI configured this a while back for use with CAC cards using the\nfollowing resources:\n\n http://alpha.uwb.edu.pl/map/eToken_gpg_howto.shtml (dead)\n http://alpha.uwb.edu.pl/amicke/eToken_gpg_howto.shtml (replacement\nfor above?)\n http://gnupg-pkcs11.sourceforge.net/man.html\n\nTry those docs. If you have questions, I'll try to find my notes.\n\n-Brandon\n"},{"id":"201874","messageId":"2180562.jsxWbf0rnE@off17","threadId":"31898","inReplyTo":"5087B8E7.8010306@drmicha.warpmail.net","subject":"Re: signing commits with openssl/PKCS#11","fromName":"Mat Arge","fromEmail":"argemat1010@gmail.com","sentAt":"2012-10-25T09:12:02Z","receivedAt":"2012-10-25T09:12:02Z","isPatch":false,"sender":{"key":"argemat1010@gmail.com","avatar":null},"body":"On Wednesday 24. October 2012 11:46:15 Michael J Gruber wrote:\n> Mat Arge venit, vidit, dixit 22.10.2012 15:38:\n> > Hy!\n> > \n> > I would like to sign each commit with a X.509 certificate and a private\n> > key\n> > stored on a PKCS#11 token. I assume that that should be possible somehow\n> > using a hook which calls openssl. Does somebody know a working\n> > implementation of this?\n> > \n> > cheers\n> > Mat\n> \n> In principle, we have an almost pluggable architecture. See for example\n> the latter part of the 2nd post in\n> \n> http://article.gmane.org/gmane.comp.version-control.git/175127\n> \n> Unless you want to change git itself, you're probably better off storing\n> your non-gpg signatures in a note (or a self-created signed tag). \n\nSo, there is no possibility to modify the commit itself via a hook, and add a, \nsay, \"opensslsig\" instead of a gpgsig tag?\n\n> To\n> sign the commit rev, you could sign the output of \"git cat-file commit\n> rev\" (or of \"git rev-parse rev\") and store that signature in a note that\n> commit. To verify, you verify the note against the commit.\n> \n> Michael\n\nBut if I crete/modify a signature file while commiting, that file wouldn't be \ncommited itself, so the signatur-file would always be one commit behind. Or am \nI missing something? I'm quite new to git (or DVCSs in general), so sorry if \nthis is a dumb question.\n\ncheers\nMat\n"},{"id":"201875","messageId":"5241827.QQWApXNz34@off17","threadId":"31898","inReplyTo":"CA+sFfMdSc30xmzFrqbPFYigLkW9v_YSrnTBtumhZiU5TKiBxqQ@mail.gmail.com","subject":"Re: signing commits with openssl/PKCS#11","fromName":"Mat Arge","fromEmail":"argemat1010@gmail.com","sentAt":"2012-10-25T09:15:06Z","receivedAt":"2012-10-25T09:15:06Z","isPatch":false,"sender":{"key":"argemat1010@gmail.com","avatar":null},"body":"On Thursday 25. October 2012 01:02:33 Brandon Casey wrote:\n> On Mon, Oct 22, 2012 at 6:38 AM, Mat Arge wrote:\n> > Hy!\n> > \n> > I would like to sign each commit with a X.509 certificate and a private\n> > key\n> > stored on a PKCS#11 token. I assume that that should be possible somehow\n> > using a hook which calls openssl. Does somebody know a working\n> > implementation of this?\n> \n> Creating signatures from an rsa key on a pkcs11 token should be\n> possible, but gnupg doesn't support pkcs11 for philosophical reasons.\n> You need to use gnupg-pkcs11 which is maintained outside of the gnupg\n> tree.\n> \n> Once you configure gnupg-pkcs11-scd, you'll be able to use git and gpg\n> to sign tags as usual.\n> \n> I configured this a while back for use with CAC cards using the\n> following resources:\n> \n> http://alpha.uwb.edu.pl/map/eToken_gpg_howto.shtml (dead)\n> http://alpha.uwb.edu.pl/amicke/eToken_gpg_howto.shtml (replacement\n> for above?)\n> http://gnupg-pkcs11.sourceforge.net/man.html\n> \n> Try those docs. If you have questions, I'll try to find my notes.\n> \n> -Brandon\n\nThanks for the tip, I will try them (though the appear to be very outdated).\nDo you know, if gnupg-pkcs11-scd is able to cooperate with the standard pcscd \nfrom pcsc-lite, or is a one-or-the-other situation?\n\ncheers\nMat\n"}]}