Not sure if this has already been mentioned in an issue, or is already in the stack somewhere, but I would really appreciate if there were a way to link your GPG key to your account so signed commits using it show up on Tangled.
Something went wrong. Try again.
Monorepo for Tangled tangled.org
Something went wrong. Try again.
Support for GPG keys #275
Closed 
anirudh.fi
anirudh.fi Closed opened by anirudh.fi
anirudh.fi Something went wrong. Try again.
6 reactions
Something went wrong. Try again.
If I made a PR is there a chance of it being accepted? or will it not at all be supported
It depends. I don't mind accepting it if the code change involved is simple enough that we can foresee maintaining it.
okay, that's a real disadvantage compared to GitLab.
Something went wrong. Try again.
@oppi.li I do believe that there's a difference between using PGP in new protocols / applications and implementing a protocol that already heavily relies on PGP. If I were to migrate any of my repositories over to Tangled, none of my commits would be verified. Likewise, a lot of git repos use PGP. Recommending that people use SSH for signing does not change that PGP signing has been used to sign a lot of git commits and that you won't be able to verify those commits.
Most of the complaints with PGP in that blog are due to its file formats that it uses. As far as I know, Git doesn't make use of those file formats and stores signatures separately. The other complaints are about GPG's default algorithms. They changed them. They no longer use those older algorithms by default for new keys.
A PGP commit verification implementation in Tangled would likely need to deal with the potential for one of those crafted malicious key files getting uploaded, but that could be handled by setting a timeout on parsing the key.
I think that you are pushing away potential users of your platform by suggesting that Tangled just shouldn't implement widely used Git features because you believe alternatives should be used now instead.
Something went wrong. Try again.
I would like to say that I am willing to implement this myself once I have the time to research Go's PGP libraries, learn Tangled's source tree structure, and implement the UI and database table necessary for storing PGP keys, along with the actual verification code.
Something went wrong. Try again.
Yup, I'm running a knot to test but its indeed a negative downer compared to other forges like forgejo/codeberg when considering a migration away from gh.
Although you might not like PGP, it is broadly used across the Git ecosystem. Lacking this feature is a real drawback for Tangled as compared to every other Git forge.
I do not plan on using Tangled if PGP-based commit verification won't be supported (and I know I am not alone in that sentiment based on reading conversations about Tangled on Discord). I already have all of my old commits signed with PGP keys and I would like to have those be verified on Tangled, too. Even smaller Git forges like Forgejo support PGP commit signature verification, and it doesn't make sense for Tangled not to.
Something went wrong. Try again.
you are not alone, I was very hesitant initially, then thought, "fine, eventually the community outside Tangled bubble will press it in"
We likely won't support this; we recommend using SSH keys to sign. This may change in the future.