Re: [RFC PATCH] gpg: add support for gpgsm

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 31, 2016, 15:46 UTC
Message-ID: <xmqqa8ler6pu.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <1459432304-35779-1-git-send-email-cmn@dwim.me>

Carlos Martín Nieto <cmn@dwim.me> writes:

Show 15 quoted lines

> Detect the gpgsm block header and run this command instead of gpg.
> On the signing side, ask gpgsm if it knows the signing key we're trying
> to use and fall back to gpg if it does not.
>
> This lets the user more easily combine signing and verifying X509 and
> PGP signatures without having to choose a default for a particular
> repository that may need to be occasionally overridden.
>
> Signed-off-by: Carlos Martín Nieto <cmn@dwim.me>
>
> ---
>
> Out there in the so-called "real world", companies like using X509 to
> sign things. Currently you can set 'gpg.program' to gpgsm to get
> gpg-compatible verification,...

I notice that you had to add GPGSM_MESSAGE string constant; does the current code without any change really work correctly if you set 'gpg.program' to gpgsm and do nothing else?

> ... but if you're changing it to swap between
> PGP and X509, it's an extra variable to keep in mind when working with
> signed commits and tags.

> +gpgsm.program::
> +	Use this custom program instead of "gpgsm" found on $PATH when
> +	making or verifying a gpsm signature. The program must support the

gpsm signature, or gpgsm signature?