Remove GPG binary deps

[sapk]

We shouldn't rely on gpg binary for gpg operations and use go libs for that.

Because we will need to support various versions of gpg binary and more action to do for users.

Example:

gitea/modules/git/repo_gpg.go

Line 18 in fcb535c

"gpg -a --export",

Related issue: #10682

[zeripath]

Git requires gpg binary in any case.

[sapk]

@zeripath we shouldn't use the git binary also 😄.

[CirnoT]

@sapk While an interesting idea, it's not really viable to write our own implementation of Git

[sapk]

For git binary, we already have started to remove some parts that were using the git cli by go-git lib but it is a very long running task and we should not go the same way with gpg.

[CirnoT]

Like I said, not feasible unless go-git receives actual funding from some big name company, look at compatibility chart, it doesn't even allow simple merges: https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md

It would definitely be nice to see go-git improve it's compatibility but the truth is, there isn't much force being put into making any git-compatible alternative simply because git itself is open source. For example GitHub uses modified version of git binary entirely and generally delegate lot of hard work there, wrapped in shell scripts. Then there is a fact that Go is only one language, and with how much work is put into git in general, it's impossible to fathom fully compatible library that keeps track of all new features as they come for every popular programming language.

All of these issues are valid and will be even more pronounced and fatal (after all, it deals with encryption) for gpg.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

[lunny]

At least, this part could be replaced by Golang library. Let's remove GPG case by case. @zeripath

[CirnoT]

Please don't, there is no reason to spread resources and use different things in different places. We're not getting rid of GPG binary either way so there is absolutely no reason to waste time on this.

[CirnoT]

Additionally using library here would most likely spell doom for any use-case where user would want to keep commit signing key in agent, and not in unencrypted form on disk for Gitea to access. I feel like this is such a huge issue that it should be mentioned in separate comment.

[zeripath]

I agree with @cirno here it seems inefficient use of resources - won't block a PR doing it but would prefer work elsewhere, like making diff more efficient. It's worth noting that go-git did not turn out to be an efficient change and may have damaged gitea's reputation. So any changes should be carefully checked.