{"thread":{"id":"63248","subject":"Git Commit Signing","startedAt":"2025-04-03T20:41:58Z","lastAt":"2025-04-03T22:08:27Z","messageCount":2,"participants":["Marrold","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"515607","messageId":"CAC-Lcd-=_dVmyy0x9N+5ap4h7UQrfkVpJaCtZnoMrkxabVR1dg@mail.gmail.com","threadId":"63248","inReplyTo":null,"subject":"Git Commit Signing","fromName":"Marrold","fromEmail":"kamailio@marrold.co.uk","sentAt":"2025-04-03T20:41:47Z","receivedAt":"2025-04-03T20:41:58Z","isPatch":false,"sender":{"key":"kamailio@marrold.co.uk","avatar":null},"body":"Hi all,\n\nI'm attempting to manually verify git commits signed with SSH keys\nusing python, however verifying commits consistently fails, no matter\nwhat I try.\n\nThe python verification logic has been tested against signatures\nproduced with ssh-keygen and confirmed to be working.\n\nI suspect I'm constructing the message incorrectly to check against\nthe signature. As far as I know, the message should look like this,\nwith the gpgsig section removed.\n\n    tree ff5ee8caaf2893a79711151b2937130469d83d39\n    parent 3e84a21590a5ad714d168878abc95218d0e42cac\n    author Matthew H <git@marrold.co.uk> 1743454803 +0100\n    committer Matthew H <git@marrold.co.uk> 1743454803 +0100\n\n    Commit message\n\nCould someone point me in the right direction? I'm wondering if its\nhashed or encoded prior to signing\n\nThanks\nMatthew\n"},{"id":"515612","messageId":"Z-8G025UUC3KpRjw@tapette.crustytoothpaste.net","threadId":"63248","inReplyTo":"CAC-Lcd-=_dVmyy0x9N+5ap4h7UQrfkVpJaCtZnoMrkxabVR1dg@mail.gmail.com","subject":"Re: Git Commit Signing","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-04-03T22:08:19Z","receivedAt":"2025-04-03T22:08:27Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-04-03 at 20:41:47, Marrold wrote:\n> Hi all,\n> \n> I'm attempting to manually verify git commits signed with SSH keys\n> using python, however verifying commits consistently fails, no matter\n> what I try.\n> \n> The python verification logic has been tested against signatures\n> produced with ssh-keygen and confirmed to be working.\n> \n> I suspect I'm constructing the message incorrectly to check against\n> the signature. As far as I know, the message should look like this,\n> with the gpgsig section removed.\n> \n>     tree ff5ee8caaf2893a79711151b2937130469d83d39\n>     parent 3e84a21590a5ad714d168878abc95218d0e42cac\n>     author Matthew H <git@marrold.co.uk> 1743454803 +0100\n>     committer Matthew H <git@marrold.co.uk> 1743454803 +0100\n> \n>     Commit message\n> \n> Could someone point me in the right direction? I'm wondering if its\n> hashed or encoded prior to signing\n\nThe message is not hashed or encoded.  It is exactly the same object as\nthe regular commit except without the `gpgsig` or `gpgsig-sha256`\nheader.  Note that that header has continuation lines starting with a\nspace that are also excluded.\n\nSo if we take this commit at the tip of my dotfiles:\n\n----\ntree 81c2ccabf6c21c811da7c7f1ecc0dd2019ebf2a2\nparent 760a2559269f6acccd1d696cbfc2447d33447e1c\nauthor brian m. carlson <sandals@crustytoothpaste.net> 1743470407 +0000\ncommitter brian m. carlson <sandals@crustytoothpaste.net> 1743470407 +0000\ngpgsig -----BEGIN PGP SIGNATURE-----\n\n wr0EABYKAG8FgmfrP2QJEHwMSWKIh6KBRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z\n LnNlcXVvaWEtcGdwLm9yZ+07Eq2NxeydVlLrWYwgP09Iw8vhBE/bPFShPSulPcqa\n FiEECCzmip28ZfuD0cORfAxJYoiHooEAAJAwAQDtYPttuP1LW9ZqyWuGNM4epDNm\n 3IyV2nezfAXxvVkB3wEAsk5U8d3Pq4GHNtE/QMc5FQ0uyI7FThHryBF6HYoLyAY=\n =ZROA\n -----END PGP SIGNATURE-----\n\nvimrc: enable virtual text in Neovim\n\nIn Neovim 0.11, virtual text is disabled by default.  Since we'd like to\nuse it if it's available, enable it explicitly.  If it's not available,\nthen the option will be ignored.\n\nSigned-off-by: brian m. carlson <sandals@crustytoothpaste.net>\n----\n\nthen the commit body that's subject to verification is this:\n\n----\ntree 81c2ccabf6c21c811da7c7f1ecc0dd2019ebf2a2\nparent 760a2559269f6acccd1d696cbfc2447d33447e1c\nauthor brian m. carlson <sandals@crustytoothpaste.net> 1743470407 +0000\ncommitter brian m. carlson <sandals@crustytoothpaste.net> 1743470407 +0000\n\nvimrc: enable virtual text in Neovim\n\nIn Neovim 0.11, virtual text is disabled by default.  Since we'd like to\nuse it if it's available, enable it explicitly.  If it's not available,\nthen the option will be ignored.\n\nSigned-off-by: brian m. carlson <sandals@crustytoothpaste.net>\n----\n\nThere can definitely be extra headers in the commit, so you can't assume\nit will always be just those, nor can you assume that the headers\n(including the signature header) will be in any particular order.\n\nDo you have an example commit, key, and command line invocation that you\ncan show us to help pinpoint the problem?  I ask because ssh-keygen\ndoesn't exactly present the most intuitive interface and it's easy to\nmake a mistake in invocation.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"}]}