{"thread":{"id":"47604","subject":"Git uses wrong subkey for signing commits with GPG key","startedAt":"2018-01-13T00:09:48Z","lastAt":"2018-01-16T18:23:37Z","messageCount":5,"participants":["Andrzej Ośmiałowski","Todd Zullinger","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"336535","messageId":"CAHLNBdVp0VTqtxHQ_cQ2XPMMDhqnQG5boj0M2JrT-iECaFUFZA@mail.gmail.com","threadId":"47604","inReplyTo":null,"subject":"Git uses wrong subkey for signing commits with GPG key","fromName":"Andrzej Ośmiałowski","fromEmail":"me@osmialowski.net","sentAt":"2018-01-13T00:09:40Z","receivedAt":"2018-01-13T00:09:48Z","isPatch":false,"sender":{"key":"me@osmialowski.net","avatar":null},"body":"I have an issue with git and signing commits with GPG subkey.\n\nMy setup:\n- master key used for certification only\n- subkey for my main workstation\n- subkey for my mobile workstation (a notebook).\n\nBoth subkeys are used for signing only.\n\nI've configured git to use my specific subkey however it does not\nwork: git config --global user.signingkey = KEYID. Every commit is\nbeing signed using the newest subkey. I've verified the same behavior\non three systems (although with the same setup). I've tried to use\n--gpg-sign=KEYID flag, but it does not work either.\n\nEnvironment:\nOS: Archlinux\nShell: ZSH\nGPG: 2.2.4\nGit: 2.15.1.\n\nIs there any other info I shall provide?\n"},{"id":"336536","messageId":"20180113002221.GQ29313@zaya.teonanacatl.net","threadId":"47604","inReplyTo":"CAHLNBdVp0VTqtxHQ_cQ2XPMMDhqnQG5boj0M2JrT-iECaFUFZA@mail.gmail.com","subject":"Re: Git uses wrong subkey for signing commits with GPG key","fromName":"Todd Zullinger","fromEmail":"tmz@pobox.com","sentAt":"2018-01-13T00:22:21Z","receivedAt":"2018-01-13T00:22:30Z","isPatch":false,"sender":{"key":"tmz@pobox.com","avatar":"https://avatars.githubusercontent.com/u/806319?v=4"},"body":"Hi Andrzej,\n\nAndrzej Ośmiałowski wrote:\n> I have an issue with git and signing commits with GPG subkey.\n> \n> My setup:\n> - master key used for certification only\n> - subkey for my main workstation\n> - subkey for my mobile workstation (a notebook).\n> \n> Both subkeys are used for signing only.\n> \n> I've configured git to use my specific subkey however it does not\n> work: git config --global user.signingkey = KEYID. Every commit is\n> being signed using the newest subkey. I've verified the same behavior\n> on three systems (although with the same setup). I've tried to use\n> --gpg-sign=KEYID flag, but it does not work either.\n\nI could be wrong, but I think you need to append '!' to\nKEYID to force gpg to use that specific signing subkey.\n\n-- \nTodd\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nA vacuum is a hell of a lot better than some of the stuff that nature\nreplaces it with.\n    -- Tennessee Williams\n\n"},{"id":"336557","messageId":"CAHLNBdUTWTbvkLdqbvB-1vs=oPJOHP5S3CWMZbtCgBnJNh4hRQ@mail.gmail.com","threadId":"47604","inReplyTo":"20180113002221.GQ29313@zaya.teonanacatl.net","subject":"Re: Git uses wrong subkey for signing commits with GPG key","fromName":"Andrzej Ośmiałowski","fromEmail":"me@osmialowski.net","sentAt":"2018-01-13T12:40:20Z","receivedAt":"2018-01-13T12:40:26Z","isPatch":false,"sender":{"key":"me@osmialowski.net","avatar":null},"body":"Hi Todd,\n\nOn Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:\n> Hi Andrzej,\n>\n> Andrzej Ośmiałowski wrote:\n>> I have an issue with git and signing commits with GPG subkey.\n>>\n>> My setup:\n>> - master key used for certification only\n>> - subkey for my main workstation\n>> - subkey for my mobile workstation (a notebook).\n>>\n>> Both subkeys are used for signing only.\n>>\n>> I've configured git to use my specific subkey however it does not\n>> work: git config --global user.signingkey = KEYID. Every commit is\n>> being signed using the newest subkey. I've verified the same behavior\n>> on three systems (although with the same setup). I've tried to use\n>> --gpg-sign=KEYID flag, but it does not work either.\n>\n> I could be wrong, but I think you need to append '!' to\n> KEYID to force gpg to use that specific signing subkey.\n>\n> --\n> Todd\n> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n> A vacuum is a hell of a lot better than some of the stuff that nature\n> replaces it with.\n>     -- Tennessee Williams\n>\n\nthanks for reply. You just solved my issue. I will prepare a PR to the\ndocs to add relevant information.\n"},{"id":"336561","messageId":"20180113172555.GS29313@zaya.teonanacatl.net","threadId":"47604","inReplyTo":"CAHLNBdUTWTbvkLdqbvB-1vs=oPJOHP5S3CWMZbtCgBnJNh4hRQ@mail.gmail.com","subject":"Re: Git uses wrong subkey for signing commits with GPG key","fromName":"Todd Zullinger","fromEmail":"tmz@pobox.com","sentAt":"2018-01-13T17:25:55Z","receivedAt":"2018-01-13T17:26:11Z","isPatch":false,"sender":{"key":"tmz@pobox.com","avatar":"https://avatars.githubusercontent.com/u/806319?v=4"},"body":"Andrzej Ośmiałowski wrote:\n> On Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:\n>> I could be wrong, but I think you need to append '!' to\n>> KEYID to force gpg to use that specific signing subkey.\n[...]\n> thanks for reply. You just solved my issue. I will prepare a PR to the\n> docs to add relevant information.\n\nGlad it helped.  The git-tag documentation points to\ngit-config and the user.signingKey variable in the\nCONFIGURATION section.  The git-config documentation for\nthat variable currently says:\n\n    If linkgit:git-tag[1] or linkgit:git-commit[1] is not selecting the\n    key you want it to automatically when creating a signed tag or\n    commit, you can override the default selection with this variable.\n    This option is passed unchanged to gpg's --local-user parameter,\n    so you may specify a key using any method that gpg supports.\n\nWhether that can be improved without being too verbose (or\nduplicating too much of the gpg documentation), I don't\nknow.\n\nMaybe it could point to the gpg documentation, though that\ncan be in gpg(1), gpg1(1), or gpg2(1), depending on how\ntheir system installs gpg.\n\nThe online link covering the many formats that gpg accepts\nfor the --local-user (-u) option is:\n\n    https://www.gnupg.org/documentation/manuals/gnupg/Specify-a-User-ID.html\n\n-- \nTodd\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nIt is impossible to enjoy idling thoroughly unless one has plenty of\nwork to do.\n    -- Jerome K. Jerome\n\n"},{"id":"336663","messageId":"xmqqlggxvf1c.fsf@gitster.mtv.corp.google.com","threadId":"47604","inReplyTo":"20180113172555.GS29313@zaya.teonanacatl.net","subject":"Re: Git uses wrong subkey for signing commits with GPG key","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-01-16T18:23:27Z","receivedAt":"2018-01-16T18:23:37Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Todd Zullinger <tmz@pobox.com> writes:\n\n> Glad it helped.  The git-tag documentation points to\n> git-config and the user.signingKey variable in the\n> CONFIGURATION section.  The git-config documentation for\n> that variable currently says:\n> ...\n>     so you may specify a key using any method that gpg supports.\n>\n> Whether that can be improved without being too verbose (or\n> duplicating too much of the gpg documentation), I don't\n> know.\n\nYeah, I personally do not want to see Git's documentation sound more\nautoritative than it actually is wrt how to use software from other\npeople, especially given that we do not have volunteers who will\nclosely be keeping track of their changes in order to update our\ndocumentation.  So \"any method that gpg supports\" is a good place to\nstop from that point of view.  \"See documentation for the version of\nPGP software you use for details.\" is not a bad thing to add without\nrisking to go stale, though.\n\n"}]}