Re: Git-commits mailing list feed.
On Sat, Apr 23, 2005 at 11:30:36AM -0700, Linus Torvalds wrote:
Show 21 quoted lines
> On Sat, 23 Apr 2005, Thomas Glanzmann wrote:
> > # This creates the signature.
> > gpg --clearsign < sign_this > signature
>
> This really doesn't work for me - I do not want to have the gpg header
> above it, only the signature below. Since I want git to actually
> understand the tags, but do _not_ want git to have to know about whatever
> signing method was used, I really want the resulting file to look like
>
> commit ....
> tag ...
>
> here goes comment
> here goes signature
>
> and no headers.
>
> Whether that can be faked by always forcing SHA1 as the hash, and then
> just removing the top lines, and re-inserting them when verifying, or
> whether there is some mode to make gpg not do the header crud at all, I
> don't know. Which is exactly why I never even got started.
It is a bit more messy, but it can be done with a detached signature.
To sign,
gpg -ab unsigned_commit
cat unsigned_commit unsigned_commit.asc > signed_commitTo verify,
cat signed_commit | sed '/-----BEGIN PGP/Q' | gpg --verify signed_commit -Jan
Jan Harkes <jaharkes@cs.cmu.edu>