GPG Signing: let user provide signature

[zeripath]

Although we now have a way of automatically signing commits, these will be signed with a key held on the server.

Some users might prefer to sign things themselves without having their private key on the server but would still want to sign automated commits.

This could be supported by presenting to the user the payload of a commit to sign which they could respond with a valid signature which is to be embedded in the commit.

This would require some changes to our temporary pushing repositories as the commits would need to hang around or be recalculated each time. The user probably would also need some way of checking that the commit they're signing actually represents what they think they're signing.

Assuming such problems are not insurmountable two immediate extensions come to mind:

• Add openpgpjs to streamline the signature process
• Allow re-signing of a series of commits

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

[lunny]

#14483 may resolve the problem. A private gpg key could be stored in secrets manager and be used when necessary.