Matthias Maier <[email protected]> writes: > On Sun, Oct 5, 2025, at 01:21 CDT, Eli Schwartz <[email protected]> wrote: > >> Thanks for acknowledging that, though I wonder what the point of >> mentioning it at all, was. :) > > Because sometimes it's good to acknowledge that there is an opportunity > cost in our choices (in this case a technically better / cleaner > solution compared to gnupg exists). But in our case we have a reasonably > well functioning solution already in place - so the benefits absolutely > do not outweigh the costs. So a pragmatic response to mgorny's e-mail is > to simply make "whatever gnupg as packaged in Gentoo" does the technical > requirement. If things deteriorate we have to reconsider [1].
Yes, that is true. > > > >> Also, re footnote 2, it very much does not simplify things, quite the >> opposite. Just saying. ;) > > I don't quite agree with this statement - but I also think discussing it > is a moot point. > > But I want to point out - as was already mentioned in this thread - git > already supports pgp, ssh, and x509 based signatures. > > So considering our Gentoo infrastructure (with ldap, key management, our > custom gitolite and signature verification [2]), the fact that we are using > pgp signatures is really a minor detail. > > > > On Sun, Oct 5, 2025, at 08:47 CDT, Sam James <[email protected]> wrote: > >> Yes. I only want to hear "SSH signing" mentioned alongside a proposal >> which handles these issues. > > I apologize that I upset you with my mentioning of "SSH signing". ;) It's just that it's the obvious retort. What I'm interested in hearing is how can emulate our existing setup with alternatives, or adjust it in hopefully small ways that would fit w/ ssh. (For example, I am not sure how well - if at all - the CA infra works for SSH.) > > We could simply takes our current procedure as codified in various > proposals and replace the signing parts by a generic (and unspecified) > signing procedure. This would give you "signing agility" so to speak > without changing any of our procedures. > > But I suggest we look into this when and if the need arises. > > Currently, gnupg is functioning just fine - *heck* I can even sign this > e-mail with it [3]. > > Best, > Matthias > > [1] To a degree gnupg without patches is already incompatible with > alternative implementations following the other standard, so this > isn't a pure hypothetical. > > [2] We, in particular, do not use a "web of trust" with gnupg, but > rather simple password based authentication when it comes to key > management. > But we do use a web of trust, we have the L[n] keys and we make use of that for e.g. signing developer keys (as well as for infra managing access to devboxes). That could be replaced by LDAP at least for the latter part though, not so much for the former AFAIK (not sure if 'ssh keyrings' exist in some exportable forat). > [3] After removing the token2, resinserting the yubikey and stopping > the pcscd daemon *grrr* ...
