[tech] Signing Gemini capsules

[ew.gemini]

Hello,


nervuri <nervuri@disroot.org> writes:

> On Sun, Mar 07, 2021, Francesco Camuffo wrote:
>>Hi.
>>
>>I made a very basic proof-of-concept program [1] to check the signify
>>signature of a resource.
>>
>>[1] https://git.sr.ht/~fmac/gemisign
>
>snip
> My recommendation is to merge key.pub, SHA256SUMS and SHA256SUMS.sig
> into a single file, to reduce the number of network requests.  I
> considered concatenating them within a plaintext file (using a separator
> like "~~~"), but then I discovered signify's -z option, which signs a
> gzip archive and embeds the signature in the gzip header.  GPG can do
> something similar - see `gpgtar`.
>
> Using an archive in this way has several benefits:
>
> * compression (which actually matters if you have a big SHA256SUMS file
> with long, repeating paths)
> * an elegant way to bundle as many files as we need; for instance, we
> could add `key-sources` later on
> * no separate signature file(s)
>
> I suggest `.well-known/signature-bundle` as the standard location for
> the signed archive.  It's important for this file *not* to have an
> extension, because the archive format might change later on, as software
> evolves.
>
> I wrote an implementation in POSIX Shell:
>
> https://tildegit.org/nervuri/NetSigil
>

I spent some time today to retrace what you have outlined. I was
able to create signature-bundle and extract the information from
it again.

Some time ago I wrote about my experiments here:
2020-12-17 Towards a proper FlightLog 4 -- Experiment with
gpg-Signatures
=> gemini://gemini.circumlunar.space/~ew/2020/20201217-towards-a-proper-flightlog-4.gmi

Apart from file names and such details both ways ware very
similar:
- create a list of checksums of all files in the tree
- sign this list with your secret key
- publish the corresponding public key.

The biggest difference is the use of tools.
- I use plain gpg
- you use signify-openbsd (which I did not know about)


signify-openbsd uses a different key generation mechanism.
Skimming the docs coming with the debian package did not say,
what algorithm is used. So to me this looks like "but why
another?" --- this might be my ignorance, however.

So what is the reason you choose signify-openbsd?
Is there a way to link such a signify pair of keys to my gpg
key?


Thanks for sharing this.
I especially like the fact that NetSigil is a modest shell script!

Cheers,
~ew



-- 
Keep it simple!