Decoupling GPG from Git
Decoupling GPG from Git
Over the last year I've been trying to understand why GPG isn't popular. Based on the features I think it's a pretty valid thing. This article changed my mind.
Turns out GPG is too old ¯_(ツ)_/¯
I like signing my commits, it feels good to know that my identity is actually attached to my code. So I put in some work to reconfigure git to use a different signing tool, I didn't think it would be such a big deal, turns out git fully intergrates GPG. I'm confused. Why does git need to be hardcoded to use GPG specifically?
What rule says we can't have git configs like:
[sigining]
defaultMethod=minisign
[signing.minisign]
always=true
signCommand=minisign -S -s {secret-key-file} -x {sig-file-name} -m {target-file}
verifyCommand=minisign -V -P {public-key-file} -m {target-file}
Where the verifyCommand exits 0 if the signature is good and 1 if not.
I'm open to hearing cons. These are some I can think of:
- User's have to configure git with each signing and verifying program
- Upstream security conserns from signing programs
- Signing programs changing their interfaces
Just wanted to say that you actually can sign git commits using SSH keys! :) It's nowhere close to being as flexible as what you suggest, but it's also not GPG, so there's that.
This is litterally just my feelings and not based of fact: but that feel icky to me to sign with ssh. IDK why but I'm just like that
I am no cryptographer, but I understand that in the SSH protocol, the keys are only used for signing anyway: that is, the user is authenticated by saying "I want to authenticate with some key, and here's some data signed by this key", and this is completely separate to encryption. It also seems that GitHub encourages using separate keys for commit signing and general SSH access, which might alleviate some of the ickyness.
You are really not wrong though, I feel like people only started using SSH for this because it kinda worked and they already have been familiar with it.
There was a proposal to add universal signing to Git in 2021, but I think it went nowhere for various reasons (like breaking SHA-1 <-> SHA-256 signing interoperability, if I understand the discussion correctly).
That's kind of a bummer
I was all set to poopoo this whole suggestion, and I read your linked article, and now I'm convinced too.
So it's difficult. Implement whatever-it-is in code is actually by far the easiest part. The hard part is the social aspect of getting everyone to do it. reddit wasn't the best-functioning link aggregator, ActivityPub is far from the best-designed federation protocol, but they're what everyone uses, so they win. gpg isn't the best, but it wins, but unlike with reddit-until-a-year-ago or ActivityPub, this is a case where that's not an acceptable outcome.
The only other input that I have is that it might be worthwhile to piggyback on existing key distribution infrastructure, like SSL certificates or people's Signal addresses. I feel like that would increase the chance of adoption. But yes, I 100% agree with this message.
The way the author just degrades using email at all isn't doing him any favours imo. Sometimes there are restrictions and certain technologies need to be used. Let's say that I need to use email but need someone to verify that it's me sending the email. PGP is an easy-ish way of doing that. It's trivial to make an SMTP server to send an email as anyone you want and have that email go through down filters. If it isn't signed though, which is much harder to forge, the other user knows I didn't send the email.
Just to be clear, I'm not advocating for PGP, I don't use PGP, I could care less if email disappears. I just think the bias is detrimental to the article
It's "bias" in favor of the truth, though. I don't think he's saying anything against email as a technology or against PGP-signing your emails as a habit -- just saying that encrypting an email with a PGP key and thinking that'll make it un-eavesdroppable is just 100% wrong backwards and forwards. That's accurate, and I think it's worth saying (I mean, I wasn't fully aware that e.g. the subject line of a PGP-encrypted email is still plaintext).