From: Jeff King <peff@peff.net>
Date: Thu, 31 Mar 2016 17:30:25 GMT
Subject: Re: [RFC PATCH] gpg: add support for gpgsm
Message-ID: <20160331173025.GA1809@sigill.intra.peff.net>
In-Reply-To: <1459440486.2124.18.camel@dwim.me>

On Thu, Mar 31, 2016 at 06:08:06PM +0200, Carlos Martín Nieto wrote:

> > I notice that you had to add GPGSM_MESSAGE string constant; does the
> > current code without any change really work correctly if you set
> > 'gpg.program' to gpgsm and do nothing else?
> 
> It does work for verify-commit which is what I've been playing around
> with since it just sends the contents of the 'gpgsig' header field to
> the verification function.
> 
> I don't recall testing with verify-tag but there we might indeed have
> issues, since we parse the contents to see if we have the signature.

Ah, right, I think I had it backwards in my earlier posting. The
"gpgsig" headers are what trigger us for signed commits, not the "BEGIN
PGP" line, and verify-tag does indeed parse the signature out.

I think we'd also fail to pick up signatures from merges of signed tags.

-Peff