Background story; government issues new IDs (eID) which can hold certificates and you can sign documents with it, using card reader and some software that signs document itself (while I do research lots of sites address this software https://store.ardaco.com/en/13-qsign-premium) + government issues software also but is not documented in english (worthless mentioning here).
I have a relative which is a doctor and faces problem with storing dozens of documents (each patients visit) in case of inspection. With new eID there is a legislation change that companies (doctors) can store documents using hard drive but all documents must be signed with eID (data integrity + timestamp).
Software (qSign) above solves one problem - signing the document(s), but does not solve recording archives (kind of like version control).
So to solve both problems I googled around and there is a possibility to use git + GPG to sign commits/tags.
When I sign "commit" does git signs file itself or just the information about commit? Is it possible to sign file also?
Is using git viable or I should just drop the idea?
I called government about the issue (did not propose using git etc. because of "IT language barrier"). Government only requires that if doctor uses option to store / archive documents on hdd it must be properly signed by eID. So when inspection comes then IT guy can confirm yes Mr. X T signed this document at 12:00am 24/1/2015.
From user guide (eID client) I can translate.
- certificate propagator
Certificate propagator after inserting eID card in card reader challenge user to insert PIN code. After valid PIN code is inserted certificates are copied to Windows Certificate Storage.
So I assume I can use these certificates to sign documents as I please.