{"thread":{"id":"45706","subject":"[REQ] Allow alternatives to gpg","startedAt":"2017-04-16T03:10:51Z","lastAt":"2017-04-16T04:43:12Z","messageCount":2,"participants":["Nathan McSween","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"316904","messageId":"9727e699-d97b-e8f2-ca48-574fc4f014af@gmail.com","threadId":"45706","inReplyTo":null,"subject":"[REQ] Allow alternatives to gpg","fromName":"Nathan McSween","fromEmail":"nwmcsween@gmail.com","sentAt":"2017-04-16T03:10:41Z","receivedAt":"2017-04-16T03:10:51Z","isPatch":false,"sender":{"key":"nwmcsween@gmail.com","avatar":null},"body":"I would like to try to make git signing pluggable, this would allow for \nusing tools such as signify[1].\nNow I'm wondering if this endeavor is worth taking and what would need \nto be changed besides\ngpg-interface?\n\n[1] http://man.openbsd.org/signify\n"},{"id":"316910","messageId":"20170416044305.dutwxrkdlv7rgj7p@sigill.intra.peff.net","threadId":"45706","inReplyTo":"9727e699-d97b-e8f2-ca48-574fc4f014af@gmail.com","subject":"Re: [REQ] Allow alternatives to gpg","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2017-04-16T04:43:05Z","receivedAt":"2017-04-16T04:43:12Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Apr 15, 2017 at 08:10:41PM -0700, Nathan McSween wrote:\n\n> I would like to try to make git signing pluggable, this would allow for\n> using tools such as signify[1].\n> Now I'm wondering if this endeavor is worth taking and what would need to be\n> changed besides\n> gpg-interface?\n> \n> [1] http://man.openbsd.org/signify\n\nI haven't used signify, but I have played around a bit with using gpgsm\nwith git. You can actually get pretty far without writing any code by\ntweaking gpg.program, as long as:\n\n  - your tool can generate and verify detached signatures\n\n  - it follows the gpg command-line convention (or you wrap it in a\n    script which converts the two)\n\nThere are a few quirks around detecting the \"BEGIN PGP MESSAGE\" block.\nIt's not necessary for tag signatures, but is for commit signatures\n(IIRC). There's some discussion in this thread:\n\n  http://public-inbox.org/git/1459432304-35779-1-git-send-email-cmn@dwim.me/T/#u\n\nWhich isn't to say we shouldn't teach Git natively to understand more\nencryption types. But it may be useful to prototype and get experience\nfirst by plugging the tool in via the config.\n\n(I don't have opinions on signify itself as a tool for general purpose\nsignatures).\n\n-Peff\n"}]}