Update gpg.txt to correct gpg --verify syntax
cover Update gpg.txt to correct gpg --verify syntax
The gpg --verify usage example within the 'gpg.program' variable reference provides an incorrect example of the gpg --verify command arguments. The command argument order, when providing both a detached signature and data, should be signature first and data second:
https://gnupg.org/documentation/manuals/gnupg/Operational-GPG-Commands.html#index-verify
.
Robert Morgan (1):
gpg(docs): use correct --verify syntax
Documentation/config/gpg.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
base-commit: 6d5b26420848ec3bc7eae46a7ffa54f20276249d
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-285%2Frtmorgan%2Fpatch-1-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-285/rtmorgan/patch-1-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/285
Signature · 1 line
gitgitgadget
PATCH 1/1 gpg(docs): use correct --verify syntax
From: Robert Morgan <[email protected]>
The gpg --verify usage example within the 'gpg.program' variable reference provides an incorrect example of the gpg --verify command arguments.
The command argument order, when providing both a detached signature and data, should be signature first and data second:
https://gnupg.org/documentation/manuals/gnupg/Operational-GPG-Commands.html
--- Documentation/config/gpg.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/config/gpg.txt +1 -1
@@ -2,7 +2,7 @@ gpg.program:: Use this custom program instead of "`gpg`" found on `$PATH` when making or verifying a PGP signature. The program must support the same command-line interface as GPG, namely, to verify a detached - signature, "`gpg --verify $file - <$signature`" is run, and the + signature, "`gpg --verify $signature - <$file`" is run, and the program is expected to signal a good signature by exiting with code 0, and to generate an ASCII-armored detached signature, the standard input of "`gpg -bsau $key`" is fed with the contents to be
Signature · 1 line
gitgitgadget
Re: [PATCH 1/1] gpg(docs): use correct --verify syntax
Documentation/config/gpg.txt gpg.program:: · line 8
Quoted 13 lines · Robert Morgan via GitGitGadget
Documentation/config/gpg.txt +1
-1@@ -2,7 +2,7 @@ gpg.program:: Use this custom program instead of "`gpg`" found on `$PATH` when making or verifying a PGP signature. The program must support the same command-line interface as GPG, namely, to verify a detached - signature, "`gpg --verify $file - <$signature`" is run, and the + signature, "`gpg --verify $signature - <$file`" is run, and the program is expected to signal a good signature by exiting with code 0, and to generate an ASCII-armored detached signature, the standard input of "`gpg -bsau $key`" is fed with the contents to be
Wow. Good find.
gpg-interface.c::verify_signed_buffer() takes a detached signature in core, writes it to a temporary file and runs
gpg --status-fd=1 --verify $the_temporary_file
and the payload that is supposed to match the given signature is fed via the standard input, so the above documentation is the only thing that needs fixing, which is good ;-)
Thanks.
Re: [PATCH 1/1] gpg(docs): use correct --verify syntax
Thanks Junio.
I was looking at 'smimesign' and working to understand how, when set within 'gpg.program', it conformed with gpg's usage within git sign,verify etc. I happened to look at the docs for the 'gpg.program' config variable and noticed the discrepancy.
Thanks again,
Robert
Quoted 32 lines · Junio C Hamano
Documentation/config/gpg.txt gpg.program:: · line 8
Quoted 13 lines · Robert Morgan via GitGitGadget
Documentation/config/gpg.txt +1
-1@@ -2,7 +2,7 @@ gpg.program:: Use this custom program instead of "`gpg`" found on `$PATH` when making or verifying a PGP signature. The program must support the same command-line interface as GPG, namely, to verify a detached - signature, "`gpg --verify $file - <$signature`" is run, and the + signature, "`gpg --verify $signature - <$file`" is run, and the program is expected to signal a good signature by exiting with code 0, and to generate an ASCII-armored detached signature, the standard input of "`gpg -bsau $key`" is fed with the contents to beWow. Good find.
gpg-interface.c::verify_signed_buffer() takes a detached signature in core, writes it to a temporary file and runs
gpg --status-fd=1 --verify $the_temporary_fileand the payload that is supposed to match the given signature is fed via the standard input, so the above documentation is the only thing that needs fixing, which is good ;-)
Thanks.