git/list[1] front-page[2] threads[3] people[4] search[5] about
 

GnuPG commit signature verification ignores GPG's status-fd and status-file options

From
NSNot Sure <kuerzn@googlemail.com>
Date
Apr 9, 2013, 11:58 UTC
Message-ID
<5164027C.4020007@googlemail.com>

Starting with the newest git version 1.8.2.1, the signature checking code somehow ignores GPG's status-fd and status-file options, which are THE way to machine parse GPG's output (seee [1])

How to reproduce:
1. Put the following line in your ~/.gnupg/gpg.conf file:
status-fd 1
2. Produce a singed commit:
git commit -aS -m "signed test commit"
3. Let git check the signature:
git log -n 1 --show-signature | cat
Output:
Commit 104cffdaaaaed653aasdddddddddd
gpg: Signature made Tue 09 Apr 2013 01:09:09 PM CEST using RSA key ID
12345678
gpg: Good signature from "User"
Author: user <usermail>
Missing from output is the machine parsable GPG information:

[GNUPG:] SIG_ID sorvifhoerui/asidunb 2013-04-09 23947273 [GNUPG:] GOODSIG 433811111111111324 User <usermail> [GNUPG:] VALIDSIG ddddddddddddddddddfsjidjfv 2013-04-09 aoidfjidh0 0 4 0 1 2 00 oshidvoo444444ddddddddd [GNUPG:] TRUST_ULTIMATE

Note: The git-log format specifiers %GG, %G?, %GK, ... do not provide
enough information, as they, for example, do not provide the
information, that the signature is valid, if the key is untrusted (which
will simply leed to a "bad" signature).

[1] http://www.gnupg.org/documentation/manuals/gnupg-devel/Unattended-Usage.html#Unattended-Usage

Next: Thomas Rast
Message 1 of 2 in “GnuPG commit signature verification ignores GPG's status-fd and status-file options”
  1. Not SureApr 9, 2013
  2. Thomas RastApr 9, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.