Re: [PATCH 8/8] gpg-interface: handle alternative signature types
- From
brian m. carlson <sandals@crustytoothpaste.net>
- Date
- Apr 14, 2018, 19:59 UTC
- Message-ID
- <20180414195954.GB14631@genre.crustytoothpaste.net>
- In-Reply-To
- <CAPig+cT3AobThgZ15iquyRQG0Qes1ZzQxycXcgHYuwQCuDEDBQ@mail.gmail.com>
On Tue, Apr 10, 2018 at 04:24:27AM -0400, Eric Sunshine wrote:
> How confident are we that _all_ possible signing programs will conform > to the "-----BEGIN %s-----" pattern? If we're not confident, then > perhaps the user should be providing the full string here, not just > the '%s' part?
This is not likely to be true of other signing schemes. In fact, other than OpenPGP, PEM, and CMS (S/MIME), this is probably not true at all. I know OpenBSD's signify has no wrappers (except a mandatory "untrusted comment:" line at the beginning). There wouldn't be a way to match such a signature unless we implemented prefix or regex support.
It's currently possible to hack other signatures in with wrappers if they wrap the actual signature in OpenPGP-like armor; someone (I believe Eric Wong) has gotten this to work with signify. I only mention signify because other than OpenPGP and CMS, it's the only scheme I've seen people use with Git.
-- brian m. carlson: Houston, Texas, US OpenPGP: https://keybase.io/bk2204