{"thread":{"id":"6547","subject":"[PATCH] Allow the tag signing key to be specified in the config file","startedAt":"2007-01-26T14:13:46Z","lastAt":"2007-01-27T22:00:53Z","messageCount":8,"participants":["Andy Parkins","Linus Torvalds","Junio C Hamano","Simon 'corecode' Schubert"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"32737","messageId":"200701261413.46823.andyparkins@gmail.com","threadId":"6547","inReplyTo":null,"subject":"[PATCH] Allow the tag signing key to be specified in the config file","fromName":"Andy Parkins","fromEmail":"andyparkins@gmail.com","sentAt":"2007-01-26T14:13:46Z","receivedAt":"2007-01-26T14:13:46Z","isPatch":true,"sender":{"key":"andyparkins@gmail.com","avatar":null},"body":"I did this:\n\n  $ git tag -s test-sign\n  gpg: skipped \"Andy Parkins <andyparkins@gmail.com>\": secret key not available\n  gpg: signing failed: secret key not available\n  failed to sign the tag with GPG.\n\nThe problem is that I have used the comment field in my key's UID\ndefinition.\n\n  $ gpg --list-keys andy\n  pub   1024D/4F712F6D 2003-08-14\n  uid                  Andy Parkins (Google) <andyparkins@gmail.com>\n\nSo when git-tag looks for \"Andy Parkins <andyparkins@gmail.com>\";\nobviously it's not going to be found.\n\nThere shouldn't be a requirement that I use the same form of my name in\nmy git repository and my gpg key - I might want to be formal (Andrew) in\nmy gpg key and informal (Andy) in the repository.  Further I might have\nmultiple keys in my keyring, and might want to use one that doesn't\nmatch up with the address I use in commit messages.\n\nThis patch adds a configuration entry \"user.signingkey\" which, if\npresent, will be passed to the \"-u\" switch for gpg, allowing the tag\nsigning key to be overridden.  If the entry is not present, the fallback\nis the original method, which means existing behaviour will continue\nuntouched.\n\nSigned-off-by: Andy Parkins <andyparkins@gmail.com>\n---\nI've mentioned this problem before, but previously my patch was to make\nit work in my specific case.  This patch covers every possibility by adding\na configuration variable so users can use whatever key they want for signing.\n\nPersonally I think this is better than the git-tag -u switch, because keys\nchange so rarely that it's being purposely inconvenient to make someone with\nspecial needs use \"-u\" every time - and they'd probably have to look up their\nchosen keyid each time.\n\n\n Documentation/config.txt  |    7 +++++++\n Documentation/git-tag.txt |   10 ++++++++++\n git-tag.sh                |    8 ++++++--\n 3 files changed, 23 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 3f2fa09..6ea7c76 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -469,6 +469,13 @@ user.name::\n \tCan be overridden by the 'GIT_AUTHOR_NAME' and 'GIT_COMMITTER_NAME'\n \tenvironment variables.  See gitlink:git-commit-tree[1].\n \n+user.signingkey::\n+\tIf gitlink:git-tag[1] is not selecting the key you want it to\n+\tautomatically when creating a signed tag, you can override the\n+\tdefault selection with this variable.  This option is passed\n+\tunchanged to gpg's --local-user parameter, so you may specify a key\n+\tusing any method that gpg supports.\n+\n whatchanged.difftree::\n \tThe default gitlink:git-diff-tree[1] arguments to be used\n \tfor gitlink:git-whatchanged[1].\ndiff --git a/Documentation/git-tag.txt b/Documentation/git-tag.txt\nindex 13c7aef..3f01e0b 100644\n--- a/Documentation/git-tag.txt\n+++ b/Documentation/git-tag.txt\n@@ -70,6 +70,16 @@ OPTIONS\n \tTake the tag message from the given file.  Use '-' to\n \tread the message from the standard input.\n \n+CONFIGURATION\n+-------------\n+By default, git-tag in sign-with-default mode (-s) will use your\n+committer identity (of the form \"Your Name <your@email.address>\") to\n+find a key.  If you want to use a different default key, you can specify\n+it in the repository configuration as follows:\n+\n+[user]\n+    signingkey = <gpg-key-id>\n+\n Author\n ------\n Written by Linus Torvalds <torvalds@osdl.org>,\ndiff --git a/git-tag.sh b/git-tag.sh\nindex 94499c9..01e6526 100755\n--- a/git-tag.sh\n+++ b/git-tag.sh\n@@ -112,7 +112,11 @@ git-check-ref-format \"tags/$name\" ||\n object=$(git-rev-parse --verify --default HEAD \"$@\") || exit 1\n type=$(git-cat-file -t $object) || exit 1\n tagger=$(git-var GIT_COMMITTER_IDENT) || exit 1\n-: ${username:=$(expr \"z$tagger\" : 'z\\(.*>\\)')}\n+\n+keyid=$(git-repo-config user.signingkey)\n+if [ -z \"$keyid\" ]; then\n+\t: ${keyid:=$(expr \"z$tagger\" : 'z\\(.*>\\)')}\n+fi\n \n trap 'rm -f \"$GIT_DIR\"/TAG_TMP* \"$GIT_DIR\"/TAG_FINALMSG \"$GIT_DIR\"/TAG_EDITMSG' 0\n \n@@ -139,7 +143,7 @@ if [ \"$annotate\" ]; then\n       cat \"$GIT_DIR\"/TAG_FINALMSG ) >\"$GIT_DIR\"/TAG_TMP\n     rm -f \"$GIT_DIR\"/TAG_TMP.asc \"$GIT_DIR\"/TAG_FINALMSG\n     if [ \"$signed\" ]; then\n-\tgpg -bsa -u \"$username\" \"$GIT_DIR\"/TAG_TMP &&\n+\tgpg -bsa -u \"$keyid\" \"$GIT_DIR\"/TAG_TMP &&\n \tcat \"$GIT_DIR\"/TAG_TMP.asc >>\"$GIT_DIR\"/TAG_TMP ||\n \tdie \"failed to sign the tag with GPG.\"\n     fi\n-- \n1.5.0.rc2.gc3537-dirty\n"},{"id":"32749","messageId":"Pine.LNX.4.64.0701260802060.25027@woody.linux-foundation.org","threadId":"6547","inReplyTo":"200701261413.46823.andyparkins@gmail.com","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Linus Torvalds","fromEmail":"torvalds@linux-foundation.org","sentAt":"2007-01-26T16:03:17Z","receivedAt":"2007-01-26T16:03:17Z","isPatch":true,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Fri, 26 Jan 2007, Andy Parkins wrote:\n> \n> This patch adds a configuration entry \"user.signingkey\" which, if\n> present, will be passed to the \"-u\" switch for gpg, allowing the tag\n> signing key to be overridden.  If the entry is not present, the fallback\n> is the original method, which means existing behaviour will continue\n> untouched.\n\nFWIW: Ack. This sounds like a good idea, and the patch looks fine too.\n\n\t\tLinus\n"},{"id":"32803","messageId":"7vodolnfes.fsf@assigned-by-dhcp.cox.net","threadId":"6547","inReplyTo":"200701261413.46823.andyparkins@gmail.com","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2007-01-27T06:37:47Z","receivedAt":"2007-01-27T06:37:47Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Andy Parkins <andyparkins@gmail.com> writes:\n\n> This patch adds a configuration entry \"user.signingkey\" which, if\n> present, will be passed to the \"-u\" switch for gpg, allowing the tag\n> signing key to be overridden.  If the entry is not present, the fallback\n> is the original method, which means existing behaviour will continue\n> untouched.\n\n\n> diff --git a/git-tag.sh b/git-tag.sh\n> index 94499c9..01e6526 100755\n> --- a/git-tag.sh\n> +++ b/git-tag.sh\n> @@ -112,7 +112,11 @@ git-check-ref-format \"tags/$name\" ||\n>  object=$(git-rev-parse --verify --default HEAD \"$@\") || exit 1\n>  type=$(git-cat-file -t $object) || exit 1\n>  tagger=$(git-var GIT_COMMITTER_IDENT) || exit 1\n> -: ${username:=$(expr \"z$tagger\" : 'z\\(.*>\\)')}\n> +\n> +keyid=$(git-repo-config user.signingkey)\n> +if [ -z \"$keyid\" ]; then\n> +\t: ${keyid:=$(expr \"z$tagger\" : 'z\\(.*>\\)')}\n> +fi\n\n\nWhy do you use \": ${parameter:=word}\" substitution after having\nalready checked that keyid is empty, I wonder...  Am I missing\nsomething subtle?\n\nOther than that, I think what this patch does makes a lot of\nsense.\n"},{"id":"32829","messageId":"200701271155.53519.andyparkins@gmail.com","threadId":"6547","inReplyTo":"7vodolnfes.fsf@assigned-by-dhcp.cox.net","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Andy Parkins","fromEmail":"andyparkins@gmail.com","sentAt":"2007-01-27T11:55:51Z","receivedAt":"2007-01-27T11:55:51Z","isPatch":true,"sender":{"key":"andyparkins@gmail.com","avatar":null},"body":"On Saturday 2007, January 27 06:37, Junio C Hamano wrote:\n\n> Why do you use \": ${parameter:=word}\" substitution after having\n> already checked that keyid is empty, I wonder...  Am I missing\n> something subtle?\n\nNope.  Just that I didn't know what the \":\"-notation on a bash line \nbefore and couldn't find documentation covering it, so I played safe \nand left it untouched.\n\nFeel free to drop the enclosing \"if\".\n\n\nAndy\n-- \nDr Andrew Parkins, M Eng (Hons), AMIEE\nandyparkins@gmail.com\n"},{"id":"32837","messageId":"45BB55B4.5090303@fs.ei.tum.de","threadId":"6547","inReplyTo":"7vodolnfes.fsf@assigned-by-dhcp.cox.net","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Simon 'corecode' Schubert","fromEmail":"corecode@fs.ei.tum.de","sentAt":"2007-01-27T13:37:56Z","receivedAt":"2007-01-27T13:37:56Z","isPatch":true,"sender":{"key":"corecode@fs.ei.tum.de","avatar":"https://gravatar.com/avatar/eff9dbf0cdac0d1e6a6cd7ed0e50763edcb376b493b5253a35ff167918ad79e1?d=mp&s=160"},"body":"Junio C Hamano wrote:\n>> +\t: ${keyid:=$(expr \"z$tagger\" : 'z\\(.*>\\)')}\n\nis there a reason to use name + email as keyid and not just the email address?  that would also mitigate the need to specify user.sigingkey if only the names missmatch between gpg and git, but the email addresses are the same.\n\ncheers\n  simon\n\n-- \nServe - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /\"\\\nWork - Mac      +++  space for low €€€ NOW!1  +++      Campaign     \\ /\nParty Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \\\nDude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \\\n\n"},{"id":"32839","messageId":"200701271624.50336.andyparkins@gmail.com","threadId":"6547","inReplyTo":"45BB55B4.5090303@fs.ei.tum.de","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Andy Parkins","fromEmail":"andyparkins@gmail.com","sentAt":"2007-01-27T16:24:48Z","receivedAt":"2007-01-27T16:24:48Z","isPatch":true,"sender":{"key":"andyparkins@gmail.com","avatar":null},"body":"On Saturday 2007, January 27 13:37, Simon 'corecode' Schubert wrote:\n\n> is there a reason to use name + email as keyid and not just the email\n> address?  that would also mitigate the need to specify user.sigingkey\n> if only the names missmatch between gpg and git, but the email\n> addresses are the same.\n\nThat was my original solution, but it was rejected.\n\nhttp://www.gelato.unsw.edu.au/archives/git/0610/29733.html\n\n\n\nAndy\n\n-- \nDr Andrew Parkins, M Eng (Hons), AMIEE\nandyparkins@gmail.com\n"},{"id":"32841","messageId":"45BB8176.9080106@fs.ei.tum.de","threadId":"6547","inReplyTo":"200701271624.50336.andyparkins@gmail.com","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Simon 'corecode' Schubert","fromEmail":"corecode@fs.ei.tum.de","sentAt":"2007-01-27T16:44:38Z","receivedAt":"2007-01-27T16:44:38Z","isPatch":true,"sender":{"key":"corecode@fs.ei.tum.de","avatar":"https://gravatar.com/avatar/eff9dbf0cdac0d1e6a6cd7ed0e50763edcb376b493b5253a35ff167918ad79e1?d=mp&s=160"},"body":"Andy Parkins wrote:\n>> is there a reason to use name + email as keyid and not just the email\n>> address?  that would also mitigate the need to specify user.sigingkey\n>> if only the names missmatch between gpg and git, but the email\n>> addresses are the same.\n> That was my original solution, but it was rejected.\n> \n> http://www.gelato.unsw.edu.au/archives/git/0610/29733.html\n\noh well.  I don't think this was discussed properly.  The question for me is, what should be the default:  fail if there is no matching key which also matches the comment field, or choose the default (sub)key even when a different subkey matches (based on the comment field).  First of all, I think the default should be \"try not to fail\", so that is the second way.  Additionally, people can specify a different keyid if they want to sign with a different key.\n\nOh well, I don't really care about this.  I just say that I'd expect it not to fail...\n\ncheers\n  simon\n\n-- \nServe - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /\"\\\nWork - Mac      +++  space for low €€€ NOW!1  +++      Campaign     \\ /\nParty Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \\\nDude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \\\n\n"},{"id":"32882","messageId":"7v64asi0yy.fsf@assigned-by-dhcp.cox.net","threadId":"6547","inReplyTo":"200701261413.46823.andyparkins@gmail.com","subject":"Re: [PATCH] Allow the tag signing key to be specified in the config file","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2007-01-27T22:00:53Z","receivedAt":"2007-01-27T22:00:53Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Thanks.\n"}]}