heroku/WAL-E — Issue #27: Provide hooks to support alternative encryption keyrings
Author: fdr
Created: 2012-01-13 05:59:52+00:00
State: open

Right now, WAL-E accepts a gpg-id option in the v0.6 branch. However, it seems totally credible to support different keyrings with not-too-huge effort. That is so one can use a system-specific keyring (such as one's Linux distribution's preferred keyring). In spite of WAL-E's fairly opinionated nature most of the time, I think cohesion with the host environment's keyring would be Very Nice. Also, although not that material to me, GnuPG is not FIPS-140 certified, and there exist keyring and cipher providers that are (`nss` in particular), and it'd be nice to have that too.

The main thing that would have to happen here is to instead identify keys by "fingerprint". Fingerprints are just SHA1 (or whatever modern cryptographic hash of the day is supported by the keyring). Luckily every system I've seen supports fingerprints as an option to address keys.

It also ends up being desirable anyway, even with GPG, if one is to support the PKCS/x509 (the standards used for TLS/SSL) keyring `gpgsm`, which as far as I can tell is distinct from the OpenPGP keyring (standard `gpg`)...gpgsm would let people use SSL-style certificates to manage their encryption. One less standard to be engaged with for a number of users.

Mechanically, this is mostly a refactoring (of names) and documentation patch in its most rudimentary form.

I want this in before v0.6 is released so that people configure the crypto key environment variable as `WALE_FINGERPRINT` instead of a variable referring to GPG.