Re: Why Do Developers Continue to Sign with GNUPG

--=-=-=
Content-Type: text/plain

Jeremy Stanley <[email protected]> writes:

> On 2025-08-10 14:35:20 +0000 (+0000), [email protected] wrote:
>> Since Debian is a major Linux distribution I want to ask why
>> software developers continue to digitally sign their code an
>> software packages with GNUPG when there are simpler alternatives
>> such as minisign (https://jedisct1.github.io/minisign/), signify, or
>> age (https://github.com/FiloSottile/age).
> [...]
>
> While I can't speak authoritatively on the matter, you hint at the
> reason already when you use the word "continue." The other solutions
> you cite are mere infants compared to the ages of Debian (1993) and
> PGP (1991). Change takes time, and supplanting things that are already
> working well enough requires that the benefit and interest needed to
> overcome the inertia of the status quo must exceed any related effort
> and disruption that implies. In short, the alternatives have to be
> way, way, way superior for an existing system to get replaced.

I believe the SSH signature format is old enough to be a relevant option
here.  SSH signatures didn't used to offer any advantage compared to
PGP, but I think now that an GnuPG-incompatible OpenPGP specification
has harmed the PGP ecosystem and made the PGP world less coherent, I
think SSH signatures offers an interesting alternative.  FWIW, Guix is
working on adding support for it, so that both SSHSIG and PGP signatures
may be used.

/Simon

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmiaYPQUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA
/iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx
+3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6
qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF
PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh
is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFoq9sAP9SKYn/FruH
cN8a6g0sdDQ4hvO0iTvTKmIeEEQZ56VvbgEA5tHcBZhjUnuV9A66v/pv8E/z9a7w
pFWevPDWw7HIygA=
=PbS4
-----END PGP SIGNATURE-----
--=-=-=--