Skip to contentSkip to conversation

GnuPG commit signature verification ignores GPG's status-fd and status-file options

DISCUSSION Not Sure 2 participants 2 messages Jun 15, 2016

lore
Share & tools
lore

Not Sure

author
#0 lore raw

Starting with the newest git version 1.8.2.1, the signature checking code somehow ignores GPG's status-fd and status-file options, which are THE way to machine parse GPG's output (seee [1])

How to reproduce:

1. Put the following line in your ~/.gnupg/gpg.conf file:

status-fd 1

2. Produce a singed commit:

git commit -aS -m "signed test commit"

3. Let git check the signature:

git log -n 1 --show-signature | cat

Output:

Commit 104cffdaaaaed653aasdddddddddd
gpg: Signature made Tue 09 Apr 2013 01:09:09 PM CEST using RSA key ID 12345678
gpg: Good signature from "User"
Author: user <usermail>

Missing from output is the machine parsable GPG information:

[GNUPG:] SIG_ID sorvifhoerui/asidunb 2013-04-09 23947273 [GNUPG:] GOODSIG 433811111111111324 User <usermail>
[GNUPG:] VALIDSIG ddddddddddddddddddfsjidjfv 2013-04-09 aoidfjidh0 0 4 0 1 2 00 oshidvoo444444ddddddddd
[GNUPG:] TRUST_ULTIMATE

Note: The git-log format specifiers %GG, %G?, %GK, ... do not provide enough information, as they, for example, do not provide the information, that the signature is valid, if the key is untrusted (which will simply leed to a "bad" signature).

[1]
http://www.gnupg.org/documentation/manuals/gnupg-devel/Unattended-Usage.html#Unattended-Usage

#1 lore raw
Quoted 1 line · Not Sure

Starting with the newest git version 1.8.2.1, the signature checking

[...]

Quoted 7 lines

Missing from output is the machine parsable GPG information:

[GNUPG:] SIG_ID sorvifhoerui/asidunb 2013-04-09 23947273 [GNUPG:] GOODSIG 433811111111111324 User <usermail>
[GNUPG:] VALIDSIG ddddddddddddddddddfsjidjfv 2013-04-09 aoidfjidh0 0 4 0 1 2 00 oshidvoo444444ddddddddd
[GNUPG:] TRUST_ULTIMATE

I suspect that's because since b60b756 (gpg-interface: check good signature in a reliable way, 2013-02-14), Git parses the above output.

Also, in e290c4b (pretty printing: extend %G? to include 'N' and 'U', 2013-03-31) which is currently in master, this was fixed:

Quoted 2 lines

Note: The git-log format specifiers %GG, %G?, %GK, ... do not provide enough information

Is anything else missing?

Signature · 2 lines
Thomas Rast
trast@{inf,student}.ethz.ch