Remove GPG binary deps #6230

New Issue

GiteaMirror · 2025-11-02T06:49:11-06:00

GiteaMirror commented

2025-11-02 06:49:11 -06:00

Originally created by @sapk on GitHub (Oct 31, 2020).

We shouldn't rely on gpg binary for gpg operations and use go libs for that.

Because we will need to support various versions of gpg binary and more action to do for users.

Example: fcb535c5c3/modules/git/repo_gpg.go (L18)

Related issue: https://github.com/go-gitea/gitea/issues/10682

Originally created by @sapk on GitHub (Oct 31, 2020). We shouldn't rely on gpg binary for gpg operations and use go libs for that. Because we will need to support various versions of gpg binary and more action to do for users. Example: https://github.com/go-gitea/gitea/blob/fcb535c5c3b6b782d9242028fed4cd8c027c4e41/modules/git/repo_gpg.go#L18 Related issue: https://github.com/go-gitea/gitea/issues/10682

GiteaMirror added the type/enhancement issue/confirmed topic/commit-signing type/refactoring labels 2025-11-02 06:49:11 -06:00

GiteaMirror commented

2025-11-02 06:49:11 -06:00

@zeripath commented on GitHub (Oct 31, 2020):

Git requires gpg binary in any case.

@zeripath commented on GitHub (Oct 31, 2020): Git requires gpg binary in any case.

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@sapk commented on GitHub (Oct 31, 2020):

@zeripath we shouldn't use the git binary also 😄.

@sapk commented on GitHub (Oct 31, 2020): @zeripath we shouldn't use the git binary also 😄.

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@CirnoT commented on GitHub (Nov 1, 2020):

@sapk While an interesting idea, it's not really viable to write our own implementation of Git

@CirnoT commented on GitHub (Nov 1, 2020): @sapk While an interesting idea, it's not really viable to write our own implementation of Git

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@sapk commented on GitHub (Nov 1, 2020):

For git binary, we already have started to remove some parts that were using the git cli by go-git lib but it is a very long running task and we should not go the same way with gpg.

@sapk commented on GitHub (Nov 1, 2020): For git binary, we already have started to remove some parts that were using the git cli by go-git lib but it is a very long running task and we should not go the same way with gpg.

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@CirnoT commented on GitHub (Nov 1, 2020):

Like I said, not feasible unless go-git receives actual funding from some big name company, look at compatibility chart, it doesn't even allow simple merges: https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md

It would definitely be nice to see go-git improve it's compatibility but the truth is, there isn't much force being put into making any git-compatible alternative simply because git itself is open source. For example GitHub uses modified version of git binary entirely and generally delegate lot of hard work there, wrapped in shell scripts. Then there is a fact that Go is only one language, and with how much work is put into git in general, it's impossible to fathom fully compatible library that keeps track of all new features as they come for every popular programming language.

All of these issues are valid and will be even more pronounced and fatal (after all, it deals with encryption) for gpg.

@CirnoT commented on GitHub (Nov 1, 2020): Like I said, not feasible unless `go-git` receives actual funding from some big name company, look at compatibility chart, it doesn't even allow simple merges: https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md It would definitely be nice to see `go-git` improve it's compatibility but the truth is, there isn't much force being put into making any git-compatible alternative simply because git itself is open source. For example GitHub uses modified version of git binary entirely and generally delegate lot of hard work there, wrapped in shell scripts. Then there is a fact that Go is only one language, and with how much work is put into git in general, it's impossible to fathom fully compatible library that keeps track of all new features as they come for every popular programming language. All of these issues are valid and will be even more pronounced and fatal (after all, it deals with encryption) for gpg.

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@stale[bot] commented on GitHub (Dec 31, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (Dec 31, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror commented

2025-11-02 06:49:12 -06:00

@lunny commented on GitHub (Jan 1, 2021):

At least, this part could be replaced by Golang library. Let's remove GPG case by case. @zeripath

@lunny commented on GitHub (Jan 1, 2021): At least, this part could be replaced by Golang library. Let's remove GPG case by case. @zeripath

GiteaMirror commented

2025-11-02 06:49:13 -06:00

@CirnoT commented on GitHub (Jan 1, 2021):

Please don't, there is no reason to spread resources and use different things in different places. We're not getting rid of GPG binary either way so there is absolutely no reason to waste time on this.

@CirnoT commented on GitHub (Jan 1, 2021): Please don't, there is no reason to spread resources and use different things in different places. We're not getting rid of GPG binary either way so there is absolutely no reason to waste time on this.

GiteaMirror commented

2025-11-02 06:49:13 -06:00

@CirnoT commented on GitHub (Jan 1, 2021):

Additionally using library here would most likely spell doom for any use-case where user would want to keep commit signing key in agent, and not in unencrypted form on disk for Gitea to access. I feel like this is such a huge issue that it should be mentioned in separate comment.

@CirnoT commented on GitHub (Jan 1, 2021): Additionally using library here would most likely spell doom for any use-case where user would want to keep commit signing key in agent, and not in unencrypted form on disk for Gitea to access. I feel like this is such a huge issue that it should be mentioned in separate comment.

GiteaMirror commented

2025-11-02 06:49:13 -06:00

@zeripath commented on GitHub (Jan 1, 2021):

I agree with @cirno here it seems inefficient use of resources - won't block a PR doing it but would prefer work elsewhere, like making diff more efficient. It's worth noting that go-git did not turn out to be an efficient change and may have damaged gitea's reputation. So any changes should be carefully checked.

@zeripath commented on GitHub (Jan 1, 2021): I agree with @cirno here it seems inefficient use of resources - won't block a PR doing it but would prefer work elsewhere, like making diff more efficient. It's worth noting that go-git did not turn out to be an efficient change and may have damaged gitea's reputation. So any changes should be carefully checked.

GiteaMirror commented

2025-11-02 06:49:13 -06:00

@lunny commented on GitHub (Jan 1, 2021):

If there is a PR for this, we need a performance test.

@lunny commented on GitHub (Jan 1, 2021): If there is a PR for this, we need a performance test.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6230