Re: [BUG] Veryfing signatures in git log fails when language is not english

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 15, 2013, 16:08 UTC
Message-ID: <7vip5twodl.fsf@alter.siamese.dyndns.org>
In-Reply-To: <CAJ9Ak2oF+SiYjStJndRZqLfnzBisn3TyXr3U_E_42BHrKbKPfQ@mail.gmail.com>

Mariusz Gronczewski <xani666@gmail.com> writes:

Show 11 quoted lines

> 2013/2/14 Junio C Hamano <gitster@pobox.com>:
>>
>>     - The "right" one you mention for %GS is easier than you might
>>       think.  If you just verify against the accompanying "tagger"
>>       identity, that should be sufficient.  It of course cannot be
>>       generally solved, as you could tag as person A while signing
>>       with key for person B, but a simple social convention would
>>       help us out there: if you tag as Mariusz Gronczewski, your
>>       signature should also say so.
> unless there is someone else with same name, which happens more often
> (so far i've seen it happen twice) than same GPG IDs.

Oh, I didn't mean to say "ignore email part", which of course will make the result more likely to be ambiguous.

I thought you meant by "have to show right one" the following scenario:

    The tag v1.8.1 has a GPG signature.  The key 96AFE6CB was used
    to sign it. The key is associated with more than one identities.
    One of them is "Junio C Hamano <gitster@pobox.com>", but that is
    not the only one.  I also have combinations of other e-mail
    addresses and names spelled differently (e.g. "Junio Hamano
    <jchXXXX@gmail.com>") that are _not_ associated with that key.

    GPG may say "good signature from A aka B aka C"; which one of A,
    B, or C should we choose?

I was suggesting that among the identities associated with the key used to sign the tag, we should show the one that matches the identity on the tagger field.

    object 5d417842efeafb6e109db7574196901c4e95d273
    type commit
    tag v1.8.1
    tagger Junio C Hamano <gitster@pobox.com> 1356992771 -0800

    Git 1.8.1
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (GNU/Linux)

    iQIc...
    =v706
    -----END PGP SIGNATURE-----

Because it is clear from the context where the signature appears that that identity is what matters for me as a signer in the project the tag appears in.

I may have other e-mail addresses that are not associated with that key, but it would be insane to put that on the tagger field of the tag, while GPG-signing with that key.