Problem signing a tag

> Nobody on the git IRC channel responded to this question, even after
> asking it a few times, so I thought I'd try here.
>
> I'm having trouble signing a tag.  I'm using this command:
>
> git tag -u EAFD344D14EA086E -F .git/TAG_EDITMSG tag_name
>
> I type in my passphrase, and am then told:
>
> error: gpg failed to sign the tag
> error: unable to sign the tag
>
> However, if I use this command:
>
> gpg -s -u EAFD344D14EA086E
>
> and use the same passphrase, it works fine. Is there any way to find out
> why a key-signing is failing?

> > Nobody on the git IRC channel responded to this question, even
> > after asking it a few times, so I thought I'd try here.
> >
> > I'm having trouble signing a tag.  I'm using this command:
> >
> > git tag -u EAFD344D14EA086E -F .git/TAG_EDITMSG tag_name
> >
> > I type in my passphrase, and am then told:
> >
> > error: gpg failed to sign the tag
> > error: unable to sign the tag
> >
> > However, if I use this command:
> >
> > gpg -s -u EAFD344D14EA086E
> >
> > and use the same passphrase, it works fine. Is there any way to
> > find out why a key-signing is failing?
>
> What does "echo $?" after it prints? IOW, maybe plain gpg fails too,
> without printing anything special, and you don't pay attention to the
> exit code. Git does. And it runs "gpg -bsau <key-id>".

> On Monday 02 November 2009, Alex Riesen said something like:
>> On Tue, Nov 3, 2009 at 01:58, Joshua J. Kugler <joshua@eeinternet.com> 
> wrote:
>>> Nobody on the git IRC channel responded to this question, even
>>> after asking it a few times, so I thought I'd try here.
>>>
>>> I'm having trouble signing a tag.  I'm using this command:
>>>
>>> git tag -u EAFD344D14EA086E -F .git/TAG_EDITMSG tag_name
>>>
>>> I type in my passphrase, and am then told:
>>>
>>> error: gpg failed to sign the tag
>>> error: unable to sign the tag
>>>
>>> However, if I use this command:
>>>
>>> gpg -s -u EAFD344D14EA086E
>>>
>>> and use the same passphrase, it works fine. Is there any way to
>>> find out why a key-signing is failing?
>>
>> What does "echo $?" after it prints? IOW, maybe plain gpg fails too,
>> without printing anything special, and you don't pay attention to the
>> exit code. Git does. And it runs "gpg -bsau <key-id>".
> 
> $ git tag -s -F .git/TAG_EDITMSG tag_name
> 
> You need a passphrase to unlock the secret key for
> user: "Joshua J. Kugler <joshua@azariah.com>"
> 1024-bit DSA key, ID 14EA086E, created 2009-08-09
> 
> gpg: problem with the agent - disabling agent use
> error: gpg failed to sign the tag
> error: unable to sign the tag
> $ echo $?
> 128
> 
> And when I sign at the prompt:
> 
> $ gpg -sa
> 
> You need a passphrase to unlock the secret key for
> user: "Joshua J. Kugler <joshua@azariah.com>"
> 1024-bit DSA key, ID 14EA086E, created 2009-08-09
> 
> gpg: problem with the agent - disabling agent use
> Blah blah blah blah
> Blah blah blah blah
> $ echo $?
> 2

> > gpg: problem with the agent - disabling agent use
> > error: gpg failed to sign the tag
> > error: unable to sign the tag
> > $ echo $?
> > 128
> >
> > And when I sign at the prompt:
> >
> > $ gpg -sa
> >
> > You need a passphrase to unlock the secret key for
> > user: "Joshua J. Kugler <joshua@azariah.com>"
> > 1024-bit DSA key, ID 14EA086E, created 2009-08-09
> >
> > gpg: problem with the agent - disabling agent use
> > Blah blah blah blah
> > Blah blah blah blah
> > $ echo $?
> > 2
>
> [...]
>
> I assume you don't want to use gpg-agent, that should be the easy way
> out.

> On Wednesday 04 November 2009, Michael J Gruber said something like:
>>> gpg: problem with the agent - disabling agent use
>>> error: gpg failed to sign the tag
>>> error: unable to sign the tag
>>> $ echo $?
>>> 128
>>>
>>> And when I sign at the prompt:
>>>
>>> $ gpg -sa
>>>
>>> You need a passphrase to unlock the secret key for
>>> user: "Joshua J. Kugler <joshua@azariah.com>"
>>> 1024-bit DSA key, ID 14EA086E, created 2009-08-09
>>>
>>> gpg: problem with the agent - disabling agent use
>>> Blah blah blah blah
>>> Blah blah blah blah
>>> $ echo $?
>>> 2
>>
>> [...]
>>
>> I assume you don't want to use gpg-agent, that should be the easy way
>> out.
> 
> Well, I could, but I just haven't set it up. :)
> 
>> If that helps you can put "--no-use-agent" in your gpg config.
> 
> I commented out use-agent in the config. That worked. THANKS!
> 
>> 2 is a non-fatal error, 128 a fatal one, btw.
> 
> Well, the 2 was from running gpg alone, and 128 was from git erroring 
> out.  According to the gpg docs:
> 
> "The program returns 0 if everything was fine, 1 if at least a signature 
> was bad, and other error codes for fatal errors."
> 
> So, the docs consider 2 a fatal error, even though it appears it isn't.  
> It seems that 
> http://github.com/git/git/blob/a6dbf8814f433a7fbfa9cde6333c98019f6db1e4/builtin-tag.c#L202 
> needs to be patched to something along the lines of:
> 
> rv = finish_command(&gpg)
> if ((rv && rv !=2)  || !len || len < 0)
> 
> Probably digging in to the gpg source code to figure out what errors are 
> and aren't fatal would be in order.
> 
> Thanks again for your help! Glad to know what I needed to do to sign my 
> tags!

> > So, the docs consider 2 a fatal error, even though it appears it
> > isn't. It seems that
> > http://github.com/git/git/blob/a6dbf8814f433a7fbfa9cde6333c98019f6d
> >b1e4/builtin-tag.c#L202 needs to be patched to something along the
> > lines of:
> >
> > rv = finish_command(&gpg)
> > if ((rv && rv !=2)  || !len || len < 0)
> >
> > Probably digging in to the gpg source code to figure out what
> > errors are and aren't fatal would be in order.
> >
> > Thanks again for your help! Glad to know what I needed to do to
> > sign my tags!
>
> Dig dig dig... gpg exits with 2 in a lot of cases, one would need to
> parse fd-error to find out more. But it also looks as if gpg exits
> normally with a good passphrase. So I tried, and at least with gpg
> 1.4.9 and git 1.6.5.2 I can sign tags with "use-agent" and without a
> running agent: I get asked for the passphrase (after reporting the
> agent MIA), and everything's fine.
>
> My gpg returns 0 in this case; it returns 2 only if I don't enter the
> passphrase. So, this seems to depend on the version of gpg. Or on
> entering the correct passphrase ;)
>
> Michael

> Dig dig dig... gpg exits with 2 in a lot of cases, one would need to
> parse fd-error to find out more. But it also looks as if gpg exits
> normally with a good passphrase. So I tried, and at least with gpg 1.4.9
> and git 1.6.5.2 I can sign tags with "use-agent" and without a running
> agent: I get asked for the passphrase (after reporting the agent MIA),
> and everything's fine.
>
> My gpg returns 0 in this case; it returns 2 only if I don't enter the
> passphrase. So, this seems to depend on the version of gpg. Or on
> entering the correct passphrase ;)

> Michael J Gruber <git@drmicha.warpmail.net> writes:
> 
>> Dig dig dig... gpg exits with 2 in a lot of cases, one would need to
>> parse fd-error to find out more. But it also looks as if gpg exits
>> normally with a good passphrase. So I tried, and at least with gpg 1.4.9
>> and git 1.6.5.2 I can sign tags with "use-agent" and without a running
>> agent: I get asked for the passphrase (after reporting the agent MIA),
>> and everything's fine.
>>
>> My gpg returns 0 in this case; it returns 2 only if I don't enter the
>> passphrase. So, this seems to depend on the version of gpg. Or on
>> entering the correct passphrase ;)
> 
> If the problematic gpg that gives 2 is older than yours, the situation
> looks to me that "exiting 2 when failed to contact agent but got a good
> passphrase some other way and successfully signed" was diagnosed as a bug
> and then fixed in gpg.  If that is the case can we find out which version
> that fix is in, and add an entry to FAQ to help next person who will be
> hit by this when using "tag -s"?

> Junio C Hamano venit, vidit, dixit 05.11.2009 21:09:
> > Michael J Gruber <git@drmicha.warpmail.net> writes:
> >> Dig dig dig... gpg exits with 2 in a lot of cases, one would need
> >> to parse fd-error to find out more. But it also looks as if gpg
> >> exits normally with a good passphrase. So I tried, and at least
> >> with gpg 1.4.9 and git 1.6.5.2 I can sign tags with "use-agent"
> >> and without a running agent: I get asked for the passphrase (after
> >> reporting the agent MIA), and everything's fine.
> >>
> >> My gpg returns 0 in this case; it returns 2 only if I don't enter
> >> the passphrase. So, this seems to depend on the version of gpg. Or
> >> on entering the correct passphrase ;)
> >
> > If the problematic gpg that gives 2 is older than yours, the
> > situation looks to me that "exiting 2 when failed to contact agent
> > but got a good passphrase some other way and successfully signed"
> > was diagnosed as a bug and then fixed in gpg.  If that is the case
> > can we find out which version that fix is in, and add an entry to
> > FAQ to help next person who will be hit by this when using "tag
> > -s"?
>
> Both of us seem to be using gpg 1.4.9, which is weird. I even checked
> Fedora's srpm, they don't apply any patches for this. For the record,
> I'm doing
>
> unset GPG_AGENT_INFO
> echo a |gpg -bsa
>
> with "use-agent" and a default key signing specified in my gpg conf.
> This returns "0" if I enter the correct passphrase (after being
> warned about the missing agent) and "2" if I enter a wrong one
> repeatedly. Joshua, your reports seem to confirm that you get 2 in
> both cases from your gpg 1.4.9, right?