git@vger.kernel.org mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
* Stable GnuPG interface, git should use GPGME
@ 2017-03-10 10:00 Bernhard E. Reiter
  2017-03-10 14:23 ` Ævar Arnfjörð Bjarmason
                   ` (2 more replies)
  0 siblings, 3 replies; 19+ messages in thread
From: Bernhard E. Reiter @ 2017-03-10 10:00 UTC (permalink / raw)
  To: git; +Cc: gnupg-devel

[-- Attachment #1: Type: text/plain, Size: 2459 bytes --]

Dear Git-Devs,

git uses an pipe-and-exec approach to running a GnuPG binary 
as writen in the documentation [1]:

    gpg.program
           Use this custom program instead of "gpg" found on $PATH when making
           or verifying a PGP signature. The program must support the same
           command-line interface as GPG

please consider using libgpgme interfacing to GnuPG, because the gpg 
command-line interface is not considered an official API to GnuPG by the 
GnuPG-devs and thus potentially unstable. 

== Details

I'm involved in GnuPG development. For most applications using libgpgme is the 
way what GnuPG-devs would recommend, also see 

  https://wiki.gnupg.org/APIs .

GnuPG devs are making a good effort of trying to keep the command-line 
interface stable, though it is not for sure. Git is only using a small part 
of the interface, so the risk when keeping the current way is small. 
Still I believe git's stability and usability would profit when moving to 
libgpgme, especially with the coming move to GnuPG 2.2, better diagnosing 
messages and for cross-plattform usage.

== Usability problem with `gpg2` vs `gpg`

My use case today was signing and git by default found the `gpg` binary by 
default and the command failed. The reason is that I have `gpg2` installed 
and most applications use it right away. So git failed signing because 
the .gnupg configuration of the user was not ready for the old `gpg` which is 
still installed on Debian GNU/Linux for purposes of the operating system. If 
git would have used libgpgme, gpgme would have choosen the most uptodate 
version of `gpg` available (or configured) without me intervening via 
gpg.program. Now because of this problem you could adding a check for `gpg2` 
and fallback to `gpg`, but even better would be to move to libgpgme. >:)

Best Regards and thanks for maintaining Git as Free Software,
Bernhard

== how to respond

ps: Please copy me on replies as I am not on git@vger.kernel.org. 
pps: I've copied gnupg-devel@ so they can see I've send this report, you don't 
have to.


[1] 
https://github.com/git/git/blob/3bc53220cb2dcf709f7a027a3f526befd021d858/Documentation/config.txt
search for 'gpg.program'.

-- 
www.intevation.de/~bernhard (CEO)     +49 541 33 508 3-3
Intevation GmbH, Osnabrück, Germany; Amtsgericht Osnabrück, HRB 18998
Owned and run by Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

^ permalink raw reply	[flat|nested] 19+ messages in thread

end of thread, other threads:[~2017-03-23 11:03 UTC | newest]

Thread overview: 19+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-10 10:00 Stable GnuPG interface, git should use GPGME Bernhard E. Reiter
2017-03-10 14:23 ` Ævar Arnfjörð Bjarmason
2017-03-13 10:14   ` Michael J Gruber
2017-03-13 12:49     ` Bernhard E. Reiter
2017-03-14 10:39       ` Michael J Gruber
2017-03-17  9:56         ` Bernhard E. Reiter
2017-03-22 17:15           ` Werner Koch
2017-03-22 18:46             ` Peter Lebbing
2017-03-23  6:52               ` Werner Koch
2017-03-23  7:29             ` Bernhard E. Reiter
2017-03-23 10:56               ` Werner Koch
2017-03-13 10:30   ` Bernhard Reiter
2017-03-10 18:54 ` Linus Torvalds
2017-03-10 20:26   ` Theodore Ts'o
2017-03-13 11:14   ` Bernhard E. Reiter
2017-03-13 12:53     ` Jeff King
2017-03-11  0:10 ` brian m. carlson
2017-03-13 12:29   ` Bernhard E. Reiter
2017-03-13 19:48   ` Christian Neukirchen

Code repositories for project(s) associated with this public inbox

	https://80x24.org/mirrors/git.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).