PGP / GPG commit signatures

[ghost]

I have configured the pgp keys
but I don't know why signing doesn't work.

[Murmele]

Hi @Developer563 can you explain more?

[exactly-one-kas]

Signing commits currently isn't implemented in Gittyup, I'm changing this to a feature request

(libgit2 supports it via git_commit_create_with_signature, but we'll have to implement creating a signature ourself, probably using gpgme)

[Akselmo]

Hi, I'm interested in this feature and maybe could try my hand at implementing it.

However, could the feature at first be just the signing process itself? Users could create the keys/signatures with other tools.

[exactly-one-kas]

Yes, just the signing would work
I'd say we simply require GPG to be installed and spawn gpg --detach-sign --armor --local-user <committer email> to create the signature

[Akselmo]

I was thinking a following plan:

• Set gpg path in settings
• If signing is enabled in repo, use gpg to sign it

But should the user be told somewhere that signing is enabled in the repository?

Also, should the user be able to toggle signing on and off for the repository?
Although I think many people who actually need this feature have already it set it up.

[exactly-one-kas]

Sounds good
Is commit.gpgsign the option to sign stuff? If so, putting that as a checkbox into the repository settings seems like a good idea
Also, using the commiter's email should probably be a fallback if user.signingkey is unset

[Akselmo]

Hey just an update, im still interested working on the feature, i just havent had the time yet due to getting a new job and life is busy.

I will get on this ASAP, but if someone else has more time than I do, im not stopping you :)

[exactly-one-kas]

Don't worry, take your time
Your life should take priority over volunteer work

[Akselmo]

git_commit_create_with_signature asks for const char *commit_content but the documentation doesn't mention what exactly is the content.

Is it git_commit_body?

[bonswouar]

Would love to see this feature implemented!

@Akselmo since it's been 13 days your might have your answer already
But just in case, according to the tests in libgit2 this commit_content is basically the whole commit content, like :

tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\n\
parent 8496071c1b46c854b31185ea97743be6a8774479\n\
author Ben Burkert <[email protected]> 1358451456 -0800\n\
committer Ben Burkert <[email protected]> 1358451456 -0800\n\
magicsig magic word: pretty please\n\
\n\
a simple commit which works\n";

See https://github.com/libgit2/libgit2/blob/ac0f2245510f6c75db1b1e7af7ca01c15dec26bc/tests/libgit2/commit/write.c#L349

[Akselmo]

Would love to see this feature implemented!

@Akselmo since it's been 13 days your might have your answer already But just in case, according to the tests in libgit2 this commit_content is basically the whole commit content, like :

tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\n\
parent 8496071c1b46c854b31185ea97743be6a8774479\n\
author Ben Burkert <[email protected]> 1358451456 -0800\n\
committer Ben Burkert <[email protected]> 1358451456 -0800\n\
magicsig magic word: pretty please\n\
\n\
a simple commit which works\n";

See https://github.com/libgit2/libgit2/blob/ac0f2245510f6c75db1b1e7af7ca01c15dec26bc/tests/libgit2/commit/write.c#L349

Thanks! I have not been working on this much due to being busy with Life:tm:, but I'll see if I can get some work done on this this weekend :)

[Akselmo]

Hm, I don't know where to place the git_commit_create_with_signature just to test it works at all.

I've tried to place it in Repository.cpp around line 629, but I'm not sure if this is the right place. Basically I'm lost in the codebase

Can anyone give me a proper walkthrough what happens when user presses the commit button? I can't get debugger working with this either, GDB just crashes. Also I had no luck trying to find the commit button signals(?) from code either.

(I dont know if this is bit too difficult for me after all..)

[bonswouar]

I've tried to place it in Repository.cpp around line 629, but I'm not sure if this is the right place. Basically I'm lost in the codebase

@Akselmo I didn't dig much into the code but it seems you're on the right track, not sure if you've got access to everything for reconstructing the raw commit data from here though, you might need to create a new method with other parameters.

Unfortunately I haven't done any cpp for years and I don't know this project at all so I won't be able to help you much more :/

[exactly-one-kas]

@Akselmo Repository::commit() would be the right place, you can create another parameter that hands in the signature or the private key

[OdinVex]

For now, you can Edit Config and add:

[commit]
	gpgSign = true
[push]
	gpgSign = true
[tag]
	gpgSign = true

Talking about this (and commit messages) in #121 because it is so similar.

Edit: I've made a Pull Request (#405) to add these features. I don't know if we'll need to put up some UI icons (locks or checkmarks?) to show 'verified' signed stuff, would be nice. I don't recall if Gittyup does that currently.

[Akselmo]

Once again I apologize for my slowness. 😅 Just wanted to say I haven't forgotten this.

Also, I am not against it if someone else can implement the solution before me.

[exactly-one-kas]

Don't worry - you're doing this for free and are free to take whatever time you want

[OdinVex]

I think I should clarify my post above, this works with an installed Gittyup (non-Flatpak, I have not tested Flatpak versions) as it uses my global git that has my GPG signing key in it and all. This might not be the expected behavior of Gittyup and may not be a solution if so.

Edit: I forgot that last year I modified Gittyup to remove code that worked with commits to use my installation's git instead, to specifically support signoff and GPG because libgit2 does support git_commit_create_with_signature, but that is required to be implemented via the software. I implemented it using host git. It was a hackish work-around I forgot about. It works, but I don't think Gittyup wants to use local git installations...even though that would bring 'your installed version of git' support. Sorry I got everyone's hopes up on that. My solution isn't a publicly-shippable one.

[Akselmo]

Hey, I have unassigned myself, since I don't really use Gittyup anymore (im trying to learn git commands :D ) and I wanted to make it clear that anyone who has interest and more time to work on this can go for it.

I may give this another try, but I hope my questions may help anyone else who will attempt this.

Sorry I couldn't make this contribution happen (for now at least!). Gittyup is great software and I hope to see it improve in future. :)

[OdinVex]

Hey, I have unassigned myself, since I don't really use Gittyup anymore (im trying to learn git commands :D ) and I wanted to make it clear that anyone who has interest and more time to work on this can go for it.

I may give this another try, but I hope my questions may help anyone else who will attempt this.

Sorry I couldn't make this contribution happen (for now at least!). Gittyup is great software and I hope to see it improve in future. :)

Yeah, it requires replacing the git backend with either shell-executed git or a different, more-featured library for git access. I had forgotten that I had essentially done that in my local clone of the repo (a number of versions old with cherry-picked updates). For now, I could suggest using git commit -S -s -m "Message" -m "Description" in a shell when committing.

[Murmele]

Hi, is it available in newer libgit2 versions? Currently I am working on updating the libgit2 version to make it upstream compatible again.
#153
Maybe you can check there

[OdinVex]

Hi, is it available in newer libgit2 versions? Currently I am working on updating the libgit2 version to make it upstream compatible again. #153 Maybe you can check there

Unfortunately, it is not available yet. Worse, it doesn't appear to be a priority.

[ghost]

I would also be interested in seeing this implemented. I like this project overall, but my org requires us to sign our commits, so unfortunately I can't use it until then.

[rimas-kudelis]

This was mentioned above in passing, but somehow only once.

It seems that GPGME library is the suggested way of using GPG from within other applications, not executing the gpg binary.

[OdinVex]

This was mentioned above in passing, but somehow only once.

It seems that GPGME library is the suggested way of using GPG from within other applications, not executing the gpg binary.

Both. Being able to call external binaries rather than built-in should have been a top priority from the start for many reasons. Bug finding, testing new binaries that don't have libraries, implementation comparison, environment restrictions, features...

[RokeJulianLockhart]

#221 (comment)

Is this a duplicate of #121 (comment)?