{"thread":{"id":"36796","subject":"Git stash gpg prompting","startedAt":"2014-05-30T20:07:16Z","lastAt":"2014-05-30T20:31:45Z","messageCount":3,"participants":["Eddie Monge","Jeff King","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"243044","messageId":"CALp-zYGRLKJfC5rVygRg8adjsxP0h2dguNSYsvmcZxq7tcEQfg@mail.gmail.com","threadId":"36796","inReplyTo":null,"subject":"Git stash gpg prompting","fromName":"Eddie Monge","fromEmail":"eddie@eddiemonge.com","sentAt":"2014-05-30T20:07:16Z","receivedAt":"2014-05-30T20:07:16Z","isPatch":false,"sender":{"key":"eddie@eddiemonge.com","avatar":null},"body":"Git stash is prompting for passphrase to try to \"sign\" the changes\nbeing stashed.\n\nReproduce:\nAdd to global gitconfig with signing key:\n```\n[commit]\n  gpgsign = true\n```\nGo to a repo, make some changes, and then run `git stash`\n\nExpected: stash the changes as normal\nActual: git prompts for passphrase (if set)\n"},{"id":"243048","messageId":"20140530202413.GD5513@sigill.intra.peff.net","threadId":"36796","inReplyTo":"CALp-zYGRLKJfC5rVygRg8adjsxP0h2dguNSYsvmcZxq7tcEQfg@mail.gmail.com","subject":"Re: Git stash gpg prompting","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2014-05-30T20:24:14Z","receivedAt":"2014-05-30T20:24:14Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, May 30, 2014 at 01:07:16PM -0700, Eddie Monge wrote:\n\n> Git stash is prompting for passphrase to try to \"sign\" the changes\n> being stashed.\n> \n> Reproduce:\n> Add to global gitconfig with signing key:\n> ```\n> [commit]\n>   gpgsign = true\n> ```\n> Go to a repo, make some changes, and then run `git stash`\n> \n> Expected: stash the changes as normal\n> Actual: git prompts for passphrase (if set)\n\nWell, yeah...stash is making a commit (two, actually), so it wants you\nto sign it. :)\n\nI suspect that using \"git notes\" has a similar problem. I can see an\nargument for not signing stashes, as they are meant to be temporary and\nnot shared. I do think notes probably should be signed.\n\nHowever, I wonder if it is really ever going to be sane to set\ncommit.gpgsign and not use something like gpg-agent. For example, if you\nwere to ever \"git rebase\" a patch series (or even just use \"git rebase\n-i\" to refactor commits), you would be prompted for your passphrase to\nsign each individual patch.\n\n-Peff\n"},{"id":"243049","messageId":"xmqqr43b80um.fsf@gitster.dls.corp.google.com","threadId":"36796","inReplyTo":"20140530202413.GD5513@sigill.intra.peff.net","subject":"Re: Git stash gpg prompting","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2014-05-30T20:31:45Z","receivedAt":"2014-05-30T20:31:45Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King <peff@peff.net> writes:\n\n> However, I wonder if it is really ever going to be sane to set\n> commit.gpgsign and not use something like gpg-agent.\n>\n> For example, if you\n> were to ever \"git rebase\" a patch series (or even just use \"git rebase\n> -i\" to refactor commits), you would be prompted for your passphrase to\n> sign each individual patch.\n\nCorrect.\n\nI actually doubt it is sane to set commit.gpgsign to true and trust\ngpg-agent, but that is a separate issue.\n"}]}