git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[Bug report] signingKey beying bypassed

From
CMCarlos Maiolino <cem@kernel.org>
Date
Dec 13, 2024, 20:23 UTC
Message-ID
<hx6q4liyd7udyezlqy2fzanxlicu24imtdqielig622sdqz2wc@lxa4ybnzyjs5>
Hello,

I have reasons to believe git isn't honoring the configured signingKey config on the .gitconfig.

the git-tag manpage states:
"
CONFIGURATION
	By default, git tag in sign-with-default mode (-s) will use your committer
	identity (of the form Your Name <your@email.address>) to find a key. If you
	want to use a different default key, you can specify it in the repository
	configuration as follows:
           [user]
               signingKey = <gpg-key-id>
"

I do have my $HOME/.gitconfig configured to always sign tags with a specific key per above documentation, and I just take it for granted. Today I had two smartcards connected, and when signing a tag, git-tag used the wrong key to sign the tag, instead of the specified in the .gitconfig.

I believe this might be a bug or some expected behavior that doesn't match the manpage. Or perhaps I misinterpreted the manpage?

- What did you expect to happen? (Expected behavior)

git-tag to sign a tag with the .gitconfig specified key or issue a warning it couldn't use it.

- What happened instead? (Actual behavior)

A tag has been signed with a key different than the one specified in the .gitconfig

I can reproduce it on any git repository in my machine, even a fresh just initiate repo.

[System Info]
git version:
git version 2.47.1
cpu: x86_64
no commit associated with this build
sizeof-long: 8
sizeof-size_t: 8
shell-path: /bin/sh
libcurl: 8.9.1
OpenSSL: OpenSSL 3.2.2 4 Jun 2024
zlib: 1.3.1.zlib-ng
compiler info: gnuc: 14.2
libc info: glibc: 2.40
$SHELL (typically, interactive shell): /bin/bash
No Enabled Hooks

Thanks Carlos

P.S. I'm not subscribed to the list, so, please Cc me on any reply.
Next: Kristoffer Haugsbakk
Message 1 of 6 in “[Bug report] signingKey beying bypassed”
  1. Carlos MaiolinoDec 13, 2024
  2. Kristoffer HaugsbakkDec 15, 2024
  3. Jeff KingDec 16, 2024
  4. Carlos MaiolinoJan 6, 2025
  5. Jeff KingJan 7, 2025
  6. Carlos MaiolinoJan 13, 2025

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.