Remove external dependencies - gpg

[dominikschulz]

It would be nice if we could get rid of our external dependencies some day.
This would allow for a nicer workflow, better error and cross platform support.
This issue is meant to track any progress / discussions on that matter for gpg.

[dominikschulz]

• https://godoc.org/golang.org/x/crypto/openpgp - The "official" PGP package by the Go authors, seems to be a little neglected and has some outstanding bugs, e.g. Secret Keyring parsing is flaky at best
  • x/crypto/openpgp: silently fail to read keyring when smartcard stub is present golang/go#9312 - Problemes reading certain secret keys from the keyring
  • https://github.com/mozilla/sops/blob/master/pgp/keysource.go - Working (?) implementation using it, including example of agent interaction

[yml]

I did exactly this in my own password management lib but now I am in dead end since golang openpgp does not support modern version of gnupg version above 2.1.

• Support for gpg2? getsops/sops#189
• gnupg 2.1 and above change the secring/pubring oleiade/serrure#6
• Find a way to support gnupg 2.1 layout yml/keep#1

[bkcsoft]

For Gitea we use https://github.com/keybase/go-crypto/tree/master/openpgp as a drop-in replacement for x/crypto/openpgp since we wanted support for new and shiny keys 🙂

[yml]

@bkcsoft do you have an example on how to make it work with gpg agent ?

Since no one has responded to my ticket : keybase/go-crypto#56
I am not yet sure how to implement this.

[jungle-boogie]

It would still be an external dependency, but it's much more of a lightweight dependency:
https://github.com/tarsnap/scrypt