[RFC] Improved git signing interface

Hi Everyone,

I have been selected by the Linux Foundation to work on a summer project. I would like to abstract the git signing interface and add support for signatures using decentralized identifiers (DID). Decentralized identifiers are an emerging standard [0] that allows individuals to control their own digital identities, and is often called self-sovereign identity (SSI). The SSIMeetup is a good place to learn more about SSI [1] and DIDs [2].

The project’s current goal is to abstract the current GPG interface into a more ‘generic’ API that supports the existing OpenPGP and X.509 functionality while creating the ability to write additional signature drivers.

I have implemented a prototype that works and passes all tests, and in the coming weeks I plan to submit a series of patches for your review. I first need to clean up the Git history to make it easy to follow. I will also ensure that people using the current approach to GPG signing can use the proposed approach with only minor changes. The flag “--gpg-sign” would evolve to “---sign”, though I would like to preserve an alias to the old flag if possible. My prototype has already implemented configuration aliases to ensure that the new approach is backwards compatible with previous configuration. I am also working to update the documentation to explain the new approach.

You can inspect my work in my fork of Git here: https://github.com/ibrahimel/did-git-impl

I created a view model diagram to describe the intended result and the files that would be impacted and can be viewed here: https://github.com/ibrahimel/did-git-impl/blob/did-git-impl-signing/Documentation/technical/signing-interface.png

This project is a continuation of David Huseby’s previous work on the subject, which can be found here: https://github.com/dhuseby/did-git-spec

Please let me know if you have any comment on the design and the previous work done so far. I look forward to learning from your experience.

Thanks, Ibrahim

[0] https://w3c-ccg.github.io/did-spec/ [1] https://ssimeetup.org/story-open-ssi-standards-drummond-reed-evernym-webinar-1/ [2] https://ssimeetup.org/decentralized-identifiers-did-fundamental-block-self-sovereign-identity-drummond-reed-webinar-2/