{"thread":{"id":"51507","subject":"[RFC] Improved git signing interface","startedAt":"2019-07-22T14:16:44Z","lastAt":"2019-08-14T08:48:38Z","messageCount":3,"participants":["Ibrahim El Rhezzali","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"379145","messageId":"CACi-FhDeAZecXSM36zroty6kpf2BCWLS=0R+dUwuB96LqFKuTA@mail.gmail.com","threadId":"51507","inReplyTo":null,"subject":"[RFC] Improved git signing interface","fromName":"Ibrahim El Rhezzali","fromEmail":"ibrahim.elrhezzali@gmail.com","sentAt":"2019-07-22T14:16:15Z","receivedAt":"2019-07-22T14:16:44Z","isPatch":false,"sender":{"key":"ibrahim.elrhezzali@gmail.com","avatar":null},"body":"Hi Everyone,\n\nI have been selected by the Linux Foundation to work on a summer\nproject. I would like to abstract the git signing interface and add\nsupport for signatures using decentralized identifiers (DID).\nDecentralized identifiers are an emerging standard [0] that allows\nindividuals to control their own digital identities, and is often\ncalled self-sovereign identity (SSI). The SSIMeetup is a good place to\nlearn more about SSI [1] and DIDs [2].\n\nThe project’s current goal is to abstract the current GPG interface\ninto a more ‘generic’ API that supports the existing OpenPGP and X.509\nfunctionality while creating the ability to write additional signature\ndrivers.\n\nI have implemented a prototype that works and passes all tests, and in\nthe coming weeks I plan to submit a series of patches for your review.\nI first need to clean up the Git history to make it easy to follow. I\nwill also ensure that people using the current approach to GPG signing\ncan use the proposed approach with only minor changes. The flag\n“--gpg-sign” would evolve to “---sign”, though I would like to\npreserve an alias to the old flag if possible. My prototype has\nalready implemented configuration aliases to ensure that the new\napproach is backwards compatible with previous configuration. I am\nalso working to update the documentation to explain the new approach.\n\nYou can inspect my work in my fork of Git here:\nhttps://github.com/ibrahimel/did-git-impl\n\nI created a view model diagram to describe the intended result and the\nfiles that would be impacted and can be viewed here:\nhttps://github.com/ibrahimel/did-git-impl/blob/did-git-impl-signing/Documentation/technical/signing-interface.png\n\nThis project is a continuation of David Huseby’s previous work on the\nsubject, which can be found here:\nhttps://github.com/dhuseby/did-git-spec\n\nPlease let me know if you have any comment on the design and the\nprevious work done so far. I look forward to learning from your\nexperience.\n\nThanks,\nIbrahim\n\n[0] https://w3c-ccg.github.io/did-spec/\n[1] https://ssimeetup.org/story-open-ssi-standards-drummond-reed-evernym-webinar-1/\n[2] https://ssimeetup.org/decentralized-identifiers-did-fundamental-block-self-sovereign-identity-drummond-reed-webinar-2/\n"},{"id":"379571","messageId":"20190730065949.GB4901@sigill.intra.peff.net","threadId":"51507","inReplyTo":"CACi-FhDeAZecXSM36zroty6kpf2BCWLS=0R+dUwuB96LqFKuTA@mail.gmail.com","subject":"Re: [RFC] Improved git signing interface","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2019-07-30T06:59:49Z","receivedAt":"2019-07-30T06:59:51Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Jul 22, 2019 at 04:16:15PM +0200, Ibrahim El Rhezzali wrote:\n\n> I have been selected by the Linux Foundation to work on a summer\n> project. I would like to abstract the git signing interface and add\n> support for signatures using decentralized identifiers (DID).\n> Decentralized identifiers are an emerging standard [0] that allows\n> individuals to control their own digital identities, and is often\n> called self-sovereign identity (SSI). The SSIMeetup is a good place to\n> learn more about SSI [1] and DIDs [2].\n> \n> The project’s current goal is to abstract the current GPG interface\n> into a more ‘generic’ API that supports the existing OpenPGP and X.509\n> functionality while creating the ability to write additional signature\n> drivers.\n\nNeat. I'm always wary of supporting \"emerging standards\", because\nsometimes they turn out not to emerge and you are left with historical\ncruft. :) But if your changes to Git are mostly around making the\nsigning config more generic, I think that is something people are\ninterested in (signify has come up as a possibility before).\n\nYou might find this discussion interesting (that patch and the\nsub-thread):\n\n https://public-inbox.org/git/20180409204129.43537-9-mastahyeti@gmail.com/\n\nOne of the points I think people didn't like was how Git would detect\nsignatures embedded in objects (i.e., is matching PEM-like lines enough,\nor what would other signing systems want?).\n\nThat patch was later dropped in favor of the work from Henning Schild:\n\n  https://public-inbox.org/git/cover.1531208187.git.henning.schild@siemens.com/\n\nwhich is much more geared at just adding gpgsm support. There were\nvarious discussions about how it could eventually be extended to new\nformats. I skimmed over the documentation from your branch and it looks\nlike a pretty sane layout, with backwards compatibility.\n\n> I have implemented a prototype that works and passes all tests, and in\n> the coming weeks I plan to submit a series of patches for your review.\n> I first need to clean up the Git history to make it easy to follow. I\n> will also ensure that people using the current approach to GPG signing\n> can use the proposed approach with only minor changes. The flag\n> “--gpg-sign” would evolve to “---sign”, though I would like to\n> preserve an alias to the old flag if possible.\n\nYes, this must not be \"minor changes\" but \"no changes\" to be accepted.\nIt's OK to deprecate things, but old options cannot immediately stop\nworking. From this email and looking at your config patches, it looks\nlike that's the route you plan to take. Good.\n\nI look forward to seeing the cleaned-up patches. :)\n\n-Peff\n"},{"id":"380429","messageId":"CACi-FhBktzoOLJMkQdWLVc1-+qJ_YuVMBy3KYbw96h9Y=hFDBQ@mail.gmail.com","threadId":"51507","inReplyTo":"20190730065949.GB4901@sigill.intra.peff.net","subject":"Re: [RFC] Improved git signing interface","fromName":"Ibrahim El Rhezzali","fromEmail":"ibrahim.elrhezzali@gmail.com","sentAt":"2019-08-14T08:48:11Z","receivedAt":"2019-08-14T08:48:38Z","isPatch":false,"sender":{"key":"ibrahim.elrhezzali@gmail.com","avatar":null},"body":"Thank you very much Jeff for looking into the proposal and for\npointing out the previous threads on the subject.\n\nI understand your concern on 'emerging technologies' and new tools.\nBut to clarify, the current work and patches do not include any new\ntools, and is merely a cleaning of the signing config and interface\nthat would make it easier in the future to add compatibility for any\nsigning tool.\n\nThe current changes maintain full backward compatibility and all\nexisting tests pass. I will hopefully be submitting the patches in the\ncoming days.\n\nThank you again for checking the proposal.\n\n -Ibrahim\n\nOn Tue, Jul 30, 2019 at 8:59 AM Jeff King <peff@peff.net> wrote:\n>\n> On Mon, Jul 22, 2019 at 04:16:15PM +0200, Ibrahim El Rhezzali wrote:\n>\n> > I have been selected by the Linux Foundation to work on a summer\n> > project. I would like to abstract the git signing interface and add\n> > support for signatures using decentralized identifiers (DID).\n> > Decentralized identifiers are an emerging standard [0] that allows\n> > individuals to control their own digital identities, and is often\n> > called self-sovereign identity (SSI). The SSIMeetup is a good place to\n> > learn more about SSI [1] and DIDs [2].\n> >\n> > The project’s current goal is to abstract the current GPG interface\n> > into a more ‘generic’ API that supports the existing OpenPGP and X.509\n> > functionality while creating the ability to write additional signature\n> > drivers.\n>\n> Neat. I'm always wary of supporting \"emerging standards\", because\n> sometimes they turn out not to emerge and you are left with historical\n> cruft. :) But if your changes to Git are mostly around making the\n> signing config more generic, I think that is something people are\n> interested in (signify has come up as a possibility before).\n>\n> You might find this discussion interesting (that patch and the\n> sub-thread):\n>\n>  https://public-inbox.org/git/20180409204129.43537-9-mastahyeti@gmail.com/\n>\n> One of the points I think people didn't like was how Git would detect\n> signatures embedded in objects (i.e., is matching PEM-like lines enough,\n> or what would other signing systems want?).\n>\n> That patch was later dropped in favor of the work from Henning Schild:\n>\n>   https://public-inbox.org/git/cover.1531208187.git.henning.schild@siemens.com/\n>\n> which is much more geared at just adding gpgsm support. There were\n> various discussions about how it could eventually be extended to new\n> formats. I skimmed over the documentation from your branch and it looks\n> like a pretty sane layout, with backwards compatibility.\n>\n> > I have implemented a prototype that works and passes all tests, and in\n> > the coming weeks I plan to submit a series of patches for your review.\n> > I first need to clean up the Git history to make it easy to follow. I\n> > will also ensure that people using the current approach to GPG signing\n> > can use the proposed approach with only minor changes. The flag\n> > “--gpg-sign” would evolve to “---sign”, though I would like to\n> > preserve an alias to the old flag if possible.\n>\n> Yes, this must not be \"minor changes\" but \"no changes\" to be accepted.\n> It's OK to deprecate things, but old options cannot immediately stop\n> working. From this email and looking at your config patches, it looks\n> like that's the route you plan to take. Good.\n>\n> I look forward to seeing the cleaned-up patches. :)\n>\n> -Peff\n\n\n\n-- \nIbrahim EL RHEZZALI\nTél. +212 6 72 55 71 71\n"}]}