Re: build-aux/announce-gen: amending gpg --verify command line
Paul Eggert <[email protected]>
| Newsgroups | gmane.comp.lib.gnulib.bugs |
|---|---|
| Organization | UCLA Computer Science Department |
| Message-ID | <[email protected]> |
On 2026-08-22 08:53, Ineiev wrote: > - gpg --verify $tarballs[0].sig > + gpg --verify $tarballs[0].sig $tarballs[0] Why is this an improvement? You mention the case of a non-detached signature, but if the .sig file is (mistakenly) non-detached, why would adding $tarballs[0] change gpg's behavior? Won't gpg verify $tarballs[0].sig and ignore $tarballs[0]? > gpg emits a warning when it's absent, like > > gpg: assuming signed data in 'file.tar.gz' As I understand it, that line is merely informational; it's not a warning. If the warning is annoying, perhaps we should use gpg's --quiet option?