[RFC] cryptographic signatures - compared to monotone?

[John A Meinel]

James Blackwell wrote:
> On Mon, Feb 13, 2006 at 09:00:26AM +0000, Magnus Therning wrote:
>> On Mon, Feb 13, 2006 at 07:50:15AM +0100, Jan Hudec wrote:
>>> On Sun, Feb 12, 2006 at 16:15:52 +0200, Jari Aalto wrote:
>>>> I've noticed that there are are many new exiting fetures proposed and
>>>> being discussed. Many new commands and options and the like.
>>>>
>>>> Perhaps the developers are already thinking about this, but I feel
>>>> that the design should take into account the cryptographic signatures
>>>> along with proposed new functionality.
>>> Alrady implemented. For quite some time IIRC.
>>>
>>> See http://wiki.bazaar.canonical.com/ConfiguringBzr for how to set it
>>> up.
>> How do I make a branch require signatures? (I.e. so that
>> "create_signatures=when-required" is triggered.)
> 
> You can locally require the creation of signatures for any or all branches
> on your local machine. I am aware of no way to check the signatures that
> have been made.
> 
>  If you want all new commits to all branches you commit to be signed, then
>  add the following option to ~/.bazaar/bazaar.conf (example):
> 
> [DEFAULT]
> check_signatures=require
> 
> 
>  If you want to sign all new commits for a specific branch then add this to
>  the appropriate branch stanza in .bazaar/branches.conf:
> 
> [/home/jblack/test]
> check_signatures=require
> 
> 
> No, this is not a typo. This is verified behaviour.
>             ~~~~~~~~~~
> 
> Use check_signatures if you wish to indicate you wish to make signatures
> when you commit. As far as I can tell the config option
> "create_signatures" does nothing. I'll leave it for someone else to define
> what the behaviour of this config option is.

That is the knob I was missing. I went to setup signatures when Robert
first merged them. And set "create_signatures=always". And nothing ever
happened. (By the way, I consider the current behavior broken, and will
happily review a patch which makes create_signatures actually create
signatures, and check_signatures actually check signatures. :)

So I just went back and signed all of my commits to the bzr tree in
jam-integration.
Unfortunately, bzr won't download signatures for revisions it already
thinks it has, but I did see 'pull' download some .sig files from robert
c & jamesh, so I know it will get new ones.

I suppose we could add a 'pull-sigs' command, or something to get all
signatures.
Or we could just wait for versioned-file which puts them in their own
weave/knit. Which should make it easier to get them anyway.

I also wanted to ask a gpg question. I have gpg-agent setup on both my
Linux box and my Mac OSX box. They are both using 'pinentry-curses'
since I ssh into my Linux box, and Mac doesn't support pinentry-qt.

The problem is that if I type "gpg --clearsign" the pinentry dialog
comes up, and I can enter my password, everything works fine.
But when bzr spawns gpg --clearsign, gpg fails to run pinentry.
Which means before I commit anything, I have to run gpg --cl manually.
Now, this used to happen with baz, so it isn't newly introduced with
bzr. But I *really* would like it to work properly. Do we need to pass
TERM, or something to gpg to get it to do the right thing? Or are we
closing file descriptors, which means it can't figure out the terminal?

The other bogus thing with gpg is that if you don't have the agent
running, it will still accept your password, and still generate a valid
signature, but it will exit with code 2 (the same as for a failed
signature).

I think it would be useful to have a more advanced handling of gpg. So
if we get pyme usable for checking signatures, we could also use it for
signing signatures. (If gpg_signing_command=='gpg').

(And as an aside, pinentry-qt works just fine on platforms that have it.
But it doesn't talk through the terminal, it goes straight to X).

John
=:->

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 249 bytes
Desc: OpenPGP digital signature
Url : https://lists.ubuntu.com/archives/bazaar/attachments/20060214/b2e0a7e0/attachment.pgp