Re: libcurl dependency for implementing RFC3161 timestamps

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 9, 2016, 18:53 UTC
Message-ID: <xmqq7fhbiitc.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <59de05c280143e7dd3ead6139df7a525.squirrel@faumail.uni-erlangen.de>

"Anton Wuerfel" <anton.wuerfel@fau.de> writes:

Show 12 quoted lines

> Is there any best-practice how to introduce this libcurl dependency? There
> are several options:
>
> -As git tag is a builtin part of the main git executable, introduce a
> libcurl dependency for the main executable (maybe not best-practice).
>
> -Move git tag to a separate git-tag binary and introduce a libcurl
> dependency to this new submodule.
>
> -Create an own submodule like git-http-timestamp with a libcurl dependency
> and call it from git tag and from other places where timestamp signatures
> are needed.

If this were to become part of the official Git distribution, I think the last one would be the most realistic approach.

In fact, just like the way that Git does not care how GPG implements its crypto, manages the chain of trust, and any other details, I think the best way to integrate it would be to write your own RFC3161 program that can be invoked just like we invoke GPG, and drive it via an interface like we drive GPG via gpg-interface.[ch], since Git shouldn't even care where your timestamp is coming from and over what transport.