I'm looking at the existing commit signing and verification integration and it is all GPG specific. I'm interested in refactoring the code to have a generic signing/verifying interface so that "drivers" for other signing tools can be created and other signing tools can be used (e.g. OpenBSD signify). The existing interface defined in gpg-interface.h is already fairly generic. It looks like the only things that would need to be fixed are the names of some members in the signature_check struct and the GPG specific constants. I propose to rename the gpg-interface.h file to signature-interface.h. There are several different ways to do the "polymorphism" needed to have a base signature_check struct with a tool-specific part for storing the tool-specific data (e.g. gpg_output, gpg_status, result). I'm looking for suggestions on the way this has been done in other places in the Git code so I can do it the same way. My initial impulse it to have a union of tool-specific structs inside of the signature_check struct. The plan for changing the signing behavior is to change the code looking for commit.gpgsign in sequencer.c to instead look for commit.signtool. The string value will define which signing tool to use. The default will be null which is the equivilent to gpgsign=false. To get GPG signing the user would set it to "gpg". To maintain backwards compatibility, the code will continue to check for commit.gpgsign and translate that to commit.signtool=gpg and output a warning. I also think that it makes sense to move the user.signingkey to be gpg.signingkey since that only makes sense in the context of GPG. The real trick here is how to handle signatures from different tools in a given project. I think the answer is to store the value of commit.signtool along with the signature blob associted with each signed commit. That way the signature verification code can know which tool to use to verify the signature. If a commit has a signture but no tool selector, the default will be to assume GPG to preserve backwards compatibility. Any other thoughts and/or suggestions? //tæ
