{"thread":{"id":"33446","subject":"GnuPG commit signature verification ignores GPG's status-fd and status-file options","startedAt":"2013-04-09T11:58:52Z","lastAt":"2013-04-09T15:22:54Z","messageCount":2,"participants":["Not Sure","Thomas Rast"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"213654","messageId":"5164027C.4020007@googlemail.com","threadId":"33446","inReplyTo":null,"subject":"GnuPG commit signature verification ignores GPG's status-fd and status-file options","fromName":"Not Sure","fromEmail":"kuerzn@googlemail.com","sentAt":"2013-04-09T11:58:52Z","receivedAt":"2013-04-09T11:58:52Z","isPatch":false,"sender":{"key":"kuerzn@googlemail.com","avatar":null},"body":"Starting with the newest git version 1.8.2.1, the signature checking\ncode somehow ignores GPG's status-fd and status-file options, which are\nTHE way to machine parse GPG's output (seee [1])\n\nHow to reproduce:\n\n1. Put the following line in your ~/.gnupg/gpg.conf file:\n\nstatus-fd 1\n\n2. Produce a singed commit:\n\ngit commit -aS -m \"signed test commit\"\n\n3. Let git check the signature:\n\ngit log -n 1 --show-signature | cat\n\nOutput:\n\nCommit 104cffdaaaaed653aasdddddddddd\ngpg: Signature made Tue 09 Apr 2013 01:09:09 PM CEST using RSA key ID\n12345678\ngpg: Good signature from \"User\"\nAuthor: user <usermail>\n\n\nMissing from output is the machine parsable GPG information:\n\n\n[GNUPG:] SIG_ID sorvifhoerui/asidunb 2013-04-09 23947273\n[GNUPG:] GOODSIG 433811111111111324 User <usermail>\n[GNUPG:] VALIDSIG ddddddddddddddddddfsjidjfv 2013-04-09 aoidfjidh0 0 4 0\n1 2 00 oshidvoo444444ddddddddd\n[GNUPG:] TRUST_ULTIMATE\n\n\n\nNote: The git-log format specifiers %GG, %G?, %GK, ... do not provide\nenough information, as they, for example, do not provide the\ninformation, that the signature is valid, if the key is untrusted (which\nwill simply leed to a \"bad\" signature).\n\n\n\n[1]\nhttp://www.gnupg.org/documentation/manuals/gnupg-devel/Unattended-Usage.html#Unattended-Usage\n"},{"id":"213665","messageId":"87vc7vlodt.fsf@linux-k42r.v.cablecom.net","threadId":"33446","inReplyTo":"5164027C.4020007@googlemail.com","subject":"Re: GnuPG commit signature verification ignores GPG's status-fd and status-file options","fromName":"Thomas Rast","fromEmail":"trast@inf.ethz.ch","sentAt":"2013-04-09T15:22:54Z","receivedAt":"2013-04-09T15:22:54Z","isPatch":false,"sender":{"key":"tr@thomasrast.ch","avatar":"https://avatars.githubusercontent.com/u/153510?v=4"},"body":"Not Sure <kuerzn@googlemail.com> writes:\n\n> Starting with the newest git version 1.8.2.1, the signature checking\n[...]\n> Missing from output is the machine parsable GPG information:\n>\n> [GNUPG:] SIG_ID sorvifhoerui/asidunb 2013-04-09 23947273\n> [GNUPG:] GOODSIG 433811111111111324 User <usermail>\n> [GNUPG:] VALIDSIG ddddddddddddddddddfsjidjfv 2013-04-09 aoidfjidh0 0 4 0\n> 1 2 00 oshidvoo444444ddddddddd\n> [GNUPG:] TRUST_ULTIMATE\n\nI suspect that's because since b60b756 (gpg-interface: check good\nsignature in a reliable way, 2013-02-14), Git parses the above output.\n\nAlso, in e290c4b (pretty printing: extend %G? to include 'N' and 'U',\n2013-03-31) which is currently in master, this was fixed:\n\n> Note: The git-log format specifiers %GG, %G?, %GK, ... do not provide\n> enough information\n\nIs anything else missing?\n\n-- \nThomas Rast\ntrast@{inf,student}.ethz.ch\n"}]}