From: Bagas Sanjaya <bagasdotme@gmail.com>
Date: Wed, 07 Jul 2021 06:26:52 GMT
Subject: Re: [PATCH] Add commit & tag signing/verification via SSH keys using ssh-keygen
Message-ID: <92d8ae43-f146-e938-d793-b8b67d810130@gmail.com>
In-Reply-To: <pull.1041.git.git.1625559593910.gitgitgadget@gmail.com>

On 06/07/21 15.19, Fabian Stelzer via GitGitGadget wrote:
> From: Fabian Stelzer <fs@gigacodes.de>
> 
> set gpg.format = ssh and user.signingkey to a ssh public key string (like from an
> authorized_keys file) and commits/tags can be signed using the private
> key from your ssh-agent.
> 
> Verification uses a allowed_signers_file (see ssh-keygen(1)) which
> defaults to .gitsigners but can be set via gpg.ssh.allowedsigners
> A possible gpg.ssh.revocationfile is also passed to ssh-keygen on
> verification.
> 
> needs openssh>8.2p1
> 

Why did you choose to implement SSH-based signing as GPG interface? Why 
not create similar one?

If at later times we need to implement other signing methods (besides 
GPG and SSH), we can refactor gpg-interface into generic signing 
interface (say `signing.h`) and let each signing methods implement from it.

-- 
An old man doll... just what I always wanted! - Clara