# Git stash gpg prompting

3 messages from 2014-05-30 to 2014-05-30. Participants: Eddie Monge, Jeff King, Junio C Hamano.
Thread: https://gitlist.dev/t/36796

## Eddie Monge, 2014-05-30 20:07

Subject: Git stash gpg prompting
Message-ID: <CALp-zYGRLKJfC5rVygRg8adjsxP0h2dguNSYsvmcZxq7tcEQfg@mail.gmail.com>
URL: https://gitlist.dev/e/CALp-zYGRLKJfC5rVygRg8adjsxP0h2dguNSYsvmcZxq7tcEQfg%40mail.gmail.com

```
Git stash is prompting for passphrase to try to "sign" the changes
being stashed.

Reproduce:
Add to global gitconfig with signing key:
ˋˋˋ
[commit]
  gpgsign = true
ˋˋˋ
Go to a repo, make some changes, and then run `git stash`

Expected: stash the changes as normal
Actual: git prompts for passphrase (if set)

```

## Jeff King, 2014-05-30 20:24

Subject: Re: Git stash gpg prompting
Message-ID: <20140530202413.GD5513@sigill.intra.peff.net>
URL: https://gitlist.dev/e/20140530202413.GD5513%40sigill.intra.peff.net
In-Reply-To: <CALp-zYGRLKJfC5rVygRg8adjsxP0h2dguNSYsvmcZxq7tcEQfg@mail.gmail.com>

```
On Fri, May 30, 2014 at 01:07:16PM -0700, Eddie Monge wrote:

> Git stash is prompting for passphrase to try to "sign" the changes
> being stashed.
> 
> Reproduce:
> Add to global gitconfig with signing key:
> ˋˋˋ
> [commit]
>   gpgsign = true
> ˋˋˋ
> Go to a repo, make some changes, and then run `git stash`
> 
> Expected: stash the changes as normal
> Actual: git prompts for passphrase (if set)

Well, yeah...stash is making a commit (two, actually), so it wants you
to sign it. :)

I suspect that using "git notes" has a similar problem. I can see an
argument for not signing stashes, as they are meant to be temporary and
not shared. I do think notes probably should be signed.

However, I wonder if it is really ever going to be sane to set
commit.gpgsign and not use something like gpg-agent. For example, if you
were to ever "git rebase" a patch series (or even just use "git rebase
-i" to refactor commits), you would be prompted for your passphrase to
sign each individual patch.

-Peff

```

## Junio C Hamano, 2014-05-30 20:31

Subject: Re: Git stash gpg prompting
Message-ID: <xmqqr43b80um.fsf@gitster.dls.corp.google.com>
URL: https://gitlist.dev/e/xmqqr43b80um.fsf%40gitster.dls.corp.google.com
In-Reply-To: <20140530202413.GD5513@sigill.intra.peff.net>

```
Jeff King <peff@peff.net> writes:

> However, I wonder if it is really ever going to be sane to set
> commit.gpgsign and not use something like gpg-agent.
>
> For example, if you
> were to ever "git rebase" a patch series (or even just use "git rebase
> -i" to refactor commits), you would be prompted for your passphrase to
> sign each individual patch.

Correct.

I actually doubt it is sane to set commit.gpgsign to true and trust
gpg-agent, but that is a separate issue.

```