Digital signature in gemini pages

[Christophe HENRY]

Le Fri, 19 Feb 2021 15:24:34 +0100,
Stephane Bortzmeyer <stephane at sources.org> a ?crit :

> On Wed, Feb 17, 2021 at 10:35:02PM +0100,
>  Christophe HENRY <listes at sbgodin.fr> wrote 
>  a message of 39 lines which said:
> 
> > Is there a way to set up pages that are signed with Gnupg?
> 
> Note that the Web does not have it. (Only channel security, through
> TLS, not actual object/data security.) It would be nice for Gemini to
> have features missing in the Web :-)

Clearly! In addition to this, even if it were possible, as web pages
embed other things it would be of no use.


> > The purpose is to make pages downloadable along with their source
> > code and signature.
> 
> May be a convention:
> 
> $URL + ".asc" MAY give you access to a signature of $URL?

Right ^^ So every browser would be able to render the page as usual.
 
There may be several modes:

* The browser is configured to not care about signature. Everything go
  as usual. Just like any non-aware browser.

* The browser is configured to indicate that this file exists, but does
  nothing. It would display a special icon https-style.

* The user would ask the browser to check for a particular site or for
  all sites.

A per-site setting would accept an error in the signature or not.

The rest follow the spirit of "Trust on first use". For instance,
storing the public key of the author in the website. Maybe a kinda
web-of-trust among some websites gathered in rings?

Say : gemini://website.invalid/.well-known/tofu/certificate

-- 
Christophe HENRY
FR EO EN - https://sbgodin.fr
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: Signature digitale OpenPGP
URL: <https://mailing-list-archive.gemi.dev/www/attachments/20210219/d2968106/attachment-0001.sig>