Re: Implementing commit signing

From: Shawn O. Pearce <spearce@spearce.org>
Date: Oct 9, 2008, 18:00 UTC
Message-ID: <20081009180026.GX8203@spearce.org>
In-Reply-To: <E74D836C8B2CEF4A89F47E8ACECEEF9B748DCD@maildub1.misys.global.ad>

"Balasubramaniam, Arunan" <Arunan.Balasubramaniam@misys.com> wrote:

Show 12 quoted lines

> Shawn O. Pearce wrote:
> 
> > But as I think about it more, if you signed the diff, excluding the
> > line offsets in the hunk headers (so file paths, context and -/+
> > lines), the "author" line and the message, leaving out the other
> > fields of the commit message, it may be possible to still include
> > the signature in an email formatted patch and carry it through a
> > "git format-patch | git am" pipeline and still have it verify.
> 
> Would this be dangerous? If you were to leave out the parent fields in
> the commit message, surely you could then reapply an old commit (that
> say introduced a bug)?

Well, the idea was to sign the diff, but in a way that would reasonably allow it to be applied with limited fuzz, such as what git-apply would accept. Thus signed changes could be emailed out by git format-patch and git send-email, and applied with git am, and the signature is still valid so long as the committer didn't mess with the patch.

Obviously if a commit was reverted and then reapplied again later, yes, the signature on the reapply may actually be valid, as the parents weren't taken into consideration.

If the format-patch output was modified to include the parent when
the signature was included then git am could be trained to verify
HEAD == parent before applying the commit.  Then you can include
the parent as part of the signature, but still enable a format-patch
and am based workflow.

Show 7 quoted lines

> > Yes, absolutely, so long as the implementation in Java was reasonably
> > sane.  E.g. we'd prefer you used a pure Java implementation of
> > GnuPG
> 
> I don't think that there is a Java GPG implementation about, some
> searching
> didn't find any live looking projects .

Bouncy Castle:  http://www.bouncycastle.org/java.html

> Would a JNI wrapper to say GPGME
> (http://www.gnupg.org/related_software/gpgme/index.en.html) be
> acceptable?

No, JNI isn't "pure Java".

-- 
Shawn.