{"thread":{"id":"36443","subject":"Git: Please allow to use gpgsm to support X.509 certificates","startedAt":"2014-04-19T11:03:07Z","lastAt":"2014-04-19T18:24:39Z","messageCount":3,"participants":["Schittli Thomas","John Keeping"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"239109","messageId":"87FCFF58480C9949AF1110DED8AC48E4E9A0D636@BASMX001.akros.ch","threadId":"36443","inReplyTo":null,"subject":"Git: Please allow to use gpgsm to support X.509 certificates","fromName":"Schittli Thomas","fromEmail":"thomas.schittli@akros.ch","sentAt":"2014-04-19T11:03:07Z","receivedAt":"2014-04-19T11:03:07Z","isPatch":false,"sender":{"key":"thomas.schittli@akros.ch","avatar":null},"body":"Dear Git community\n\nlast night, brian m. Carlson explained, that \"Git wants a key that can be used by GnuPG\" and therefore X.509 certificates are not supported.\n\nAs you probably know, since 3 years gpg supports X.509 - unfortunately, gpg does not automatically detect X.509 certificates and we have to use gpgsm instead of gpg.\nThe good thing: for identical functions, the command line arguments are identical :-)\n\nTherefore: please allow to configure git, so that it can use gpg or gpgsm.\nOr even better: if gpg fails, then please automatically try gpgsm :-)\n\n\nIt works perfectly, I just replaced gpg.exe by gpgsm.exe:\n\n1. Copied all missing *.dll and *.exe from c:\\Program Files (x86)\\GNU\\GnuPG\\ to c:\\Program Files (x86)\\Git\\bin\\\n2. renamed c:\\Program Files (x86)\\Git\\bin\\gpg.exe to c:\\Program Files (x86)\\Git\\bin\\gpg_.exe\n3. renamed c:\\Program Files (x86)\\Git\\bin\\gpgsm.exe to c:\\Program Files (x86)\\Git\\bin\\gpg.exe\n4. Imported the X.509 Certificate\n5. signed a commit:\n    $ git commit -S -m 'Test commit of foo'\n    gpgsm: DBG: adding certificates at level -2\n    gpgsm: signature created\n    [master dd5145a] Test commit of foo\n     1 file changed, 0 insertions(+), 0 deletions(-)\n     create mode 100644 test\n6. Tested the signature\n    $ git log --show-signature\n    commit dd5145aabac18f6a2fb2cd0d4a30b5064ef4c04a\n    gpgsm: Signature made 2014-04-19 10:34:53 using certificate ID 0x12345678^M\n    gpgsm: Good signature from \"/CN=xxx/O=xxx/L=xxxl/ST=xxx/C=xx/EMail=xxx@xxx.xx\"^M\n    Author: tom xxx@xxx.xx\n    Date:   Sat Apr 19 12:34:53 2014 +0200\n        Test commit of foo\n    commit b89934b6e3a86343be740f7a5a1fe446e572b5dd\n    Author: tom xxx@xxx.xx\n    Date:   Fri Apr 18 23:09:47 2014 +0200\n        Init\n\n\nThanks a lot for this really great tool!!\n\nKind regards,\nTom\n\n\n\nOn Fri, Apr 18, 2014 at 10:04:50PM +0200, Thomas Schittli wrote:\n> We already have trusted Certificates from a CA. Can we use them\n> instead of an additional PGP key?\n\nGit wants a key that can be used by GnuPG, and X.509 certificates can't\nbe.  It invokes the gpg binary that's in your path, so X.509 integration\nisn't possible unless gpg learns about it.\n\n> We already have:\n> - s/mime certificate\n> - web server ssl/tls certificate\n> - XMPP Jabber ssl/tls certificate\n> - Object Code Signing certificate\n>  \n> Or if we have to use a new pgp key: can we sign it using any of our\n> certificates?\n\nOnly in the sense that you can sign any arbitrary piece of text or data\nwith your certificates.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187"},{"id":"239113","messageId":"20140419151913.GA29656@serenity.lan","threadId":"36443","inReplyTo":"87FCFF58480C9949AF1110DED8AC48E4E9A0D636@BASMX001.akros.ch","subject":"Re: Git: Please allow to use gpgsm to support X.509 certificates","fromName":"John Keeping","fromEmail":"john@keeping.me.uk","sentAt":"2014-04-19T15:19:13Z","receivedAt":"2014-04-19T15:19:13Z","isPatch":false,"sender":{"key":"john@keeping.me.uk","avatar":"https://avatars.githubusercontent.com/u/1702081?v=4"},"body":"On Sat, Apr 19, 2014 at 11:03:07AM +0000, Schittli Thomas wrote:\n> last night, brian m. Carlson explained, that \"Git wants a key that can\n> be used by GnuPG\" and therefore X.509 certificates are not supported.\n> \n> As you probably know, since 3 years gpg supports X.509 -\n> unfortunately, gpg does not automatically detect X.509 certificates\n> and we have to use gpgsm instead of gpg.\n> The good thing: for identical functions, the command line arguments are identical :-)\n> \n> Therefore: please allow to configure git, so that it can use gpg or gpgsm.\n> Or even better: if gpg fails, then please automatically try gpgsm :-)\n\nHave you tried `git config gpg.program gpgsm`?\n"},{"id":"239119","messageId":"87FCFF58480C9949AF1110DED8AC48E4E9A0DFCF@BASMX001.akros.ch","threadId":"36443","inReplyTo":"20140419151913.GA29656@serenity.lan","subject":"AW: Git: Please allow to use gpgsm to support X.509 certificates","fromName":"Schittli Thomas","fromEmail":"thomas.schittli@akros.ch","sentAt":"2014-04-19T18:24:39Z","receivedAt":"2014-04-19T18:24:39Z","isPatch":false,"sender":{"key":"thomas.schittli@akros.ch","avatar":null},"body":"Hi John,\n\n> Have you tried `git config gpg.program gpgsm`?\n\nwau, thanks a lot for this hint!, it works :-)\n\nI think a \"seamless\" integration for all certificate-types would be better, \nbut I try to motivate GnuPG to merge the function of gpgsm.exe into gpg.exe.\nThis would give a great benefit for all applications using GnuPG.\n\nThanks a lot,\nkind regards,\nTom\n\n\n\n________________________________________\nVon: git-owner@vger.kernel.org [git-owner@vger.kernel.org]" im Auftrag von "John Keeping [john@keeping.me.uk]\nGesendet: Samstag, 19. April 2014 17:19\nAn: Schittli Thomas\nCc: git@vger.kernel.org\nBetreff: Re: Git: Please allow to use gpgsm to support X.509 certificates\n\nOn Sat, Apr 19, 2014 at 11:03:07AM +0000, Schittli Thomas wrote:\n> last night, brian m. Carlson explained, that \"Git wants a key that can\n> be used by GnuPG\" and therefore X.509 certificates are not supported.\n>\n> As you probably know, since 3 years gpg supports X.509 -\n> unfortunately, gpg does not automatically detect X.509 certificates\n> and we have to use gpgsm instead of gpg.\n> The good thing: for identical functions, the command line arguments are identical :-)\n>\n> Therefore: please allow to configure git, so that it can use gpg or gpgsm.\n> Or even better: if gpg fails, then please automatically try gpgsm :-)\n\nHave you tried `git config gpg.program gpgsm`?\n"}]}