Keybase support

[instilled]

Setting up the GPG toolchain is cumbersome (on OSx even more so). With keybase.io things got a lot easier recently. That's why I was wondering if there's an interest in bringing keybase into boot.

Changes to the existing boot.pod.gpg namespace would be marginal. I've already hacked something together that hooks into the existing boot.core.built-in/push task. Actually it alter-var-roots boot.pod.gpg/sign-jar to instilled.boot.keybase/sign-jar in a task, see here.

Instead of that hackery, if there's interest into bringing this into boot, we should find a better way to accomplish this. An env var à la BOOT_SIGN_TOOL={gpg,keybase} or an additional parameter to boot.core.built-int/push and a minor rework of boot.pod.gpg would probably just do fine.

Let me know what you think!

Cheers, Fabio

[micha]

@instilled I think this is a great idea!

I have been thinking that the push task does way too many things currently. What do you think about separating the jar signing into a separate task and deprecating the GPG stuff that's built into the existing push task? @Deraen @alandipert thoughts?

[Deraen]

Yes, separating gpg stuff makes sense.

[instilled]

@micha Awesome! Extracting jar-signing into a separate task does make a lot of sense to me. Would you then rather go for two distinct tasks, one for each signing backend (sign-gpg, sign-keybase) or having only one that is configurable? In my opinion one task should just do fine as the changes really are minimal.

[Deraen]

I think one task makes sense. It is possible that a single project will be deployed by several users who have different preferences on how to sign packages.

[instilled]

@Deraen @micha I have pushed the necessary changes to gpg namespace but have not splitted the push task. To do that I would require some guidance, mainly on how to communicate the articat-map (see here) from the sign to the push (set-env! maybe?).