Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exploration: replace gpgme with rpgp #240

Conversation

Alizter
Copy link
Contributor

@Alizter Alizter commented Oct 16, 2023

This is a way to replace gpgme with rpgp. I haven't actually tested it so it might be incorrect. I haven't bothered to update the errors just yet, but @drewdeponte you will probably want to do that himself anyway.

@Alizter Alizter added this to the 7.0.0 milestone Oct 16, 2023
@Alizter Alizter force-pushed the ps/branch/exploration__replace_gpgme_with_rpgp branch 5 times, most recently from 118dfcd to f27843c Compare October 16, 2023 14:59
Signed-off-by: Ali Caglayan <alizter@gmail.com>
Signed-off-by: Ali Caglayan <alizter@gmail.com>
@Alizter Alizter force-pushed the ps/branch/exploration__replace_gpgme_with_rpgp branch from f27843c to 8d628c8 Compare October 16, 2023 17:24
@Alizter
Copy link
Contributor Author

Alizter commented Oct 16, 2023

@drewdeponte I've pushed another commit here that tests gps ls in the way I have been talking about as an example. I don't have time to finish setting up the gpg signing just yet, but you could take this methodology and use it elsewhere. gps ls is done for example.

@drewdeponte
Copy link
Owner

@Alizter I briefly looked into this last night and it seems like the first step is just figuring out how to get the private key we need out of gpg given a key id. Because what you give to the git config in the user.signingKey property is your GPG key id.

So, I tried looking at the library, but I don't think it provides anything for reading a GPG keyring and getting a key out. So, I think we would need to externally run some gpg command to output the key to stdout, and read it in that way.

I am not sure what this gpg command would be exactly. But I think that is the next piece of research to help move this along if you want to search around.

@drewdeponte
Copy link
Owner

Actually, this might be what we want gpg --armor --export-secret-key <key-id>. I am not sure 100%.

@drewdeponte
Copy link
Owner

Thinking more about this, I think we can get rid of entire rpgp dependency as well if we just shell out to the command to do the signing. I believe this is what Git actually does. It streamlines the dependencies we have to worry about across platforms and because we are piggy backing off of the Git config we can get the info about the gpg command from that or fall back to looking for it in the path.

@drewdeponte
Copy link
Owner

@drewdeponte
Copy link
Owner

I am closing this PR because I just integrated commit ec71fc2 which replaces the nead for this as it implements gpg signing using the external gpg command.

@drewdeponte drewdeponte closed this Nov 4, 2023
@drewdeponte drewdeponte self-assigned this Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants