Gopass: Remove external dependencies - gpg

[dominikschulz]

It would be nice if we could get rid of our external dependencies some day.
This would allow for a nicer workflow, better error and cross platform support.
This issue is meant to track any progress / discussions on that matter for gpg.

[dominikschulz]

• https://godoc.org/golang.org/x/crypto/openpgp - The "official" PGP package by the Go authors, seems to be a little neglected and has some outstanding bugs, e.g. Secret Keyring parsing is flaky at best
  
  
  
  • https://github.com/golang/go/issues/9312 - Problemes reading certain secret keys from the keyring
  
  
  • https://github.com/mozilla/sops/blob/master/pgp/keysource.go - Working (?) implementation using it, including example of agent interaction
  
  

[yml]

I did exactly this in my own password management lib but now I am in dead end since golang openpgp does not support modern version of gnupg version above 2.1.

• https://github.com/mozilla/sops/issues/189
• https://github.com/oleiade/serrure/issues/6
• https://github.com/yml/keep/issues/1

[bkcsoft]

For Gitea we use https://github.com/keybase/go-crypto/tree/master/openpgp as a drop-in replacement for x/crypto/openpgp since we wanted support for new and shiny keys 🙂

[yml]

@bkcsoft do you have an example on how to make it work with gpg agent ?

Since no one has responded to my ticket : https://github.com/keybase/go-crypto/issues/56
I am not yet sure how to implement this.

[jungle-boogie]

It would still be an external dependency, but it's much more of a lightweight dependency:
https://github.com/tarsnap/scrypt