Re: Implementing commit signing

["Shawn O. Pearce" <spearce@spearce.org>]

"Balasubramaniam, Arunan" <Arunan.Balasubramaniam@misys.com> wrote:
> Shawn O. Pearce wrote:
> 
> > But as I think about it more, if you signed the diff, excluding the
> > line offsets in the hunk headers (so file paths, context and -/+
> > lines), the "author" line and the message, leaving out the other
> > fields of the commit message, it may be possible to still include
> > the signature in an email formatted patch and carry it through a
> > "git format-patch | git am" pipeline and still have it verify.
> 
> Would this be dangerous? If you were to leave out the parent fields in
> the commit message, surely you could then reapply an old commit (that
> say introduced a bug)?

Well, the idea was to sign the diff, but in a way that would
reasonably allow it to be applied with limited fuzz, such as what
git-apply would accept.  Thus signed changes could be emailed out
by git format-patch and git send-email, and applied with git am,
and the signature is still valid so long as the committer didn't
mess with the patch.

Obviously if a commit was reverted and then reapplied again later,
yes, the signature on the reapply may actually be valid, as the
parents weren't taken into consideration.

If the format-patch output was modified to include the parent when
the signature was included then git am could be trained to verify
HEAD == parent before applying the commit.  Then you can include
the parent as part of the signature, but still enable a format-patch
and am based workflow.
 
> > Yes, absolutely, so long as the implementation in Java was reasonably
> > sane.  E.g. we'd prefer you used a pure Java implementation of
> > GnuPG
> 
> I don't think that there is a Java GPG implementation about, some
> searching
> didn't find any live looking projects .

Bouncy Castle:  http://www.bouncycastle.org/java.html

> Would a JNI wrapper to say GPGME
> (http://www.gnupg.org/related_software/gpgme/index.en.html) be
> acceptable?

No, JNI isn't "pure Java".

-- 
Shawn.