On Sun, Oct 5, 2025, at 01:21 CDT, Eli Schwartz <[email protected]> wrote:
> Thanks for acknowledging that, though I wonder what the point of > mentioning it at all, was. :) Because sometimes it's good to acknowledge that there is an opportunity cost in our choices (in this case a technically better / cleaner solution compared to gnupg exists). But in our case we have a reasonably well functioning solution already in place - so the benefits absolutely do not outweigh the costs. So a pragmatic response to mgorny's e-mail is to simply make "whatever gnupg as packaged in Gentoo" does the technical requirement. If things deteriorate we have to reconsider [1]. > Also, re footnote 2, it very much does not simplify things, quite the > opposite. Just saying. ;) I don't quite agree with this statement - but I also think discussing it is a moot point. But I want to point out - as was already mentioned in this thread - git already supports pgp, ssh, and x509 based signatures. So considering our Gentoo infrastructure (with ldap, key management, our custom gitolite and signature verification [2]), the fact that we are using pgp signatures is really a minor detail. On Sun, Oct 5, 2025, at 08:47 CDT, Sam James <[email protected]> wrote: > Yes. I only want to hear "SSH signing" mentioned alongside a proposal > which handles these issues. I apologize that I upset you with my mentioning of "SSH signing". We could simply takes our current procedure as codified in various proposals and replace the signing parts by a generic (and unspecified) signing procedure. This would give you "signing agility" so to speak without changing any of our procedures. But I suggest we look into this when and if the need arises. Currently, gnupg is functioning just fine - *heck* I can even sign this e-mail with it [3]. Best, Matthias [1] To a degree gnupg without patches is already incompatible with alternative implementations following the other standard, so this isn't a pure hypothetical. [2] We, in particular, do not use a "web of trust" with gnupg, but rather simple password based authentication when it comes to key management. [3] After removing the token2, resinserting the yubikey and stopping the pcscd daemon *grrr* ...
signature.asc
Description: PGP signature
