[Bug report] signingKey beying bypassed
- From
- Carlos Maiolino <cem@kernel.org>
- Date
- Dec 13, 2024, 20:23 UTC
- Message-ID
- <hx6q4liyd7udyezlqy2fzanxlicu24imtdqielig622sdqz2wc@lxa4ybnzyjs5>
Hello,
I have reasons to believe git isn't honoring the configured signingKey config on the .gitconfig.
the git-tag manpage states:
" CONFIGURATION By default, git tag in sign-with-default mode (-s) will use your committer identity (of the form Your Name <your@email.address>) to find a key. If you want to use a different default key, you can specify it in the repository configuration as follows:
[user]
signingKey = <gpg-key-id>
"I do have my $HOME/.gitconfig configured to always sign tags with a specific key per above documentation, and I just take it for granted. Today I had two smartcards connected, and when signing a tag, git-tag used the wrong key to sign the tag, instead of the specified in the .gitconfig.
I believe this might be a bug or some expected behavior that doesn't match the manpage. Or perhaps I misinterpreted the manpage?
- What did you expect to happen? (Expected behavior)
git-tag to sign a tag with the .gitconfig specified key or issue a warning it couldn't use it.
- What happened instead? (Actual behavior)
A tag has been signed with a key different than the one specified in the .gitconfig
I can reproduce it on any git repository in my machine, even a fresh just initiate repo.
[System Info] git version: git version 2.47.1 cpu: x86_64 no commit associated with this build sizeof-long: 8 sizeof-size_t: 8 shell-path: /bin/sh libcurl: 8.9.1 OpenSSL: OpenSSL 3.2.2 4 Jun 2024 zlib: 1.3.1.zlib-ng compiler info: gnuc: 14.2 libc info: glibc: 2.40 $SHELL (typically, interactive shell): /bin/bash
No Enabled Hooks
Thanks Carlos
P.S. I'm not subscribed to the list, so, please Cc me on any reply.