threads / discuss / 47604

Git uses wrong subkey for signing commits with GPG key

Subject: Git uses wrong subkey for signing commits with GPG key

## tl;dr

5 messages between Jan 13, 2018 and Jan 16, 2018.

replies: 4people: 3as markdown or json

Andrzej Ośmiałowski· Jan 13, 2018, 00:09 UTC · lore

I have an issue with git and signing commits with GPG subkey.

My setup:
- master key used for certification only
- subkey for my main workstation
- subkey for my mobile workstation (a notebook).

Both subkeys are used for signing only.

I've configured git to use my specific subkey however it does not work: git config --global user.signingkey = KEYID. Every commit is being signed using the newest subkey. I've verified the same behavior on three systems (although with the same setup). I've tried to use --gpg-sign=KEYID flag, but it does not work either.

Environment:
OS: Archlinux
Shell: ZSH
GPG: 2.2.4
Git: 2.15.1.

Is there any other info I shall provide?

Todd Zullinger· Jan 13, 2018, 00:22 UTC · re: Andrzej Ośmiałowski · lore

Re: Git uses wrong subkey for signing commits with GPG key

Hi Andrzej,

Andrzej Ośmiałowski wrote:

Show 14 quoted lines

> I have an issue with git and signing commits with GPG subkey.
> 
> My setup:
> - master key used for certification only
> - subkey for my main workstation
> - subkey for my mobile workstation (a notebook).
> 
> Both subkeys are used for signing only.
> 
> I've configured git to use my specific subkey however it does not
> work: git config --global user.signingkey = KEYID. Every commit is
> being signed using the newest subkey. I've verified the same behavior
> on three systems (although with the same setup). I've tried to use
> --gpg-sign=KEYID flag, but it does not work either.

I could be wrong, but I think you need to append '!' to KEYID to force gpg to use that specific signing subkey.

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A vacuum is a hell of a lot better than some of the stuff that nature
replaces it with.
    -- Tennessee Williams

Andrzej Ośmiałowski· Jan 13, 2018, 12:40 UTC · re: Todd Zullinger · lore

Re: Git uses wrong subkey for signing commits with GPG key

Hi Todd,

On Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:

Show 28 quoted lines

> Hi Andrzej,
>
> Andrzej Ośmiałowski wrote:
>> I have an issue with git and signing commits with GPG subkey.
>>
>> My setup:
>> - master key used for certification only
>> - subkey for my main workstation
>> - subkey for my mobile workstation (a notebook).
>>
>> Both subkeys are used for signing only.
>>
>> I've configured git to use my specific subkey however it does not
>> work: git config --global user.signingkey = KEYID. Every commit is
>> being signed using the newest subkey. I've verified the same behavior
>> on three systems (although with the same setup). I've tried to use
>> --gpg-sign=KEYID flag, but it does not work either.
>
> I could be wrong, but I think you need to append '!' to
> KEYID to force gpg to use that specific signing subkey.
>
> --
> Todd
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> A vacuum is a hell of a lot better than some of the stuff that nature
> replaces it with.
>     -- Tennessee Williams
>

thanks for reply. You just solved my issue. I will prepare a PR to the docs to add relevant information.

Todd Zullinger· Jan 13, 2018, 17:25 UTC · re: Andrzej Ośmiałowski · lore

Re: Git uses wrong subkey for signing commits with GPG key

Andrzej Ośmiałowski wrote:

> On Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:
>> I could be wrong, but I think you need to append '!' to
>> KEYID to force gpg to use that specific signing subkey.

[...]

> thanks for reply. You just solved my issue. I will prepare a PR to the
> docs to add relevant information.

Glad it helped. The git-tag documentation points to git-config and the user.signingKey variable in the CONFIGURATION section. The git-config documentation for that variable currently says:

    If linkgit:git-tag[1] or linkgit:git-commit[1] is not selecting the
    key you want it to automatically when creating a signed tag or
    commit, you can override the default selection with this variable.
    This option is passed unchanged to gpg's --local-user parameter,
    so you may specify a key using any method that gpg supports.

Whether that can be improved without being too verbose (or duplicating too much of the gpg documentation), I don't know.

Maybe it could point to the gpg documentation, though that can be in gpg(1), gpg1(1), or gpg2(1), depending on how their system installs gpg.

The online link covering the many formats that gpg accepts for the --local-user (-u) option is:

    https://www.gnupg.org/documentation/manuals/gnupg/Specify-a-User-ID.html

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It is impossible to enjoy idling thoroughly unless one has plenty of
work to do.
    -- Jerome K. Jerome

Junio C Hamano· Jan 16, 2018, 18:23 UTC · re: Todd Zullinger · lore

Re: Git uses wrong subkey for signing commits with GPG key

Todd Zullinger <tmz@pobox.com> writes:

Show 10 quoted lines

> Glad it helped.  The git-tag documentation points to
> git-config and the user.signingKey variable in the
> CONFIGURATION section.  The git-config documentation for
> that variable currently says:
> ...
>     so you may specify a key using any method that gpg supports.
>
> Whether that can be improved without being too verbose (or
> duplicating too much of the gpg documentation), I don't
> know.

Yeah, I personally do not want to see Git's documentation sound more autoritative than it actually is wrt how to use software from other people, especially given that we do not have volunteers who will closely be keeping track of their changes in order to update our documentation. So "any method that gpg supports" is a good place to stop from that point of view. "See documentation for the version of PGP software you use for details." is not a bad thing to add without risking to go stale, though.