Re: build-aux/announce-gen: amending gpg --verify command line
Bruno Haible via Gnulib discussion list <[email protected]>
| Newsgroups | gmane.comp.lib.gnulib.bugs |
|---|---|
| Message-ID | <9123310.gMo3ACIZaO@cagnes> |
Paul Eggert wrote: > > - gpg --verify $tarballs[0].sig > > + gpg --verify $tarballs[0].sig $tarballs[0] > > Why is this an improvement? You mention the case of a non-detached signature, but if the .sig file is (mistakenly) non-detached, why would adding $tarballs[0] change gpg's behavior? Won't gpg verify $tarballs[0].sig and ignore $tarballs[0]? > > > gpg emits a warning when it's absent, like > > > > gpg: assuming signed data in 'file.tar.gz' > > As I understand it, that line is merely informational; it's not a warning. Yes, but it's clutter. See: $ gpg --verify gettext-1.0.tar.lz.sig gpg: assuming signed data in 'gettext-1.0.tar.lz' gpg: Signature made Do 29 Jan 2026 01:14:03 CET gpg: using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08 gpg: Good signature from "Bruno Haible (Free Software Development) <[email protected]>" [ultimate] $ gpg --verify gettext-1.0.tar.lz.sig gettext-1.0.tar.lz gpg: Signature made Do 29 Jan 2026 01:14:03 CET gpg: using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08 gpg: Good signature from "Bruno Haible (Free Software Development) <[email protected]>" [ultimate] > If the warning is annoying, perhaps we should use gpg's --quiet option? The --quiet option has no effect here: $ gpg --verify --quiet gettext-1.0.tar.lz.sig gpg: assuming signed data in 'gettext-1.0.tar.lz' gpg: Signature made Do 29 Jan 2026 01:14:03 CET gpg: using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08 gpg: Good signature from "Bruno Haible (Free Software Development) <[email protected]>" [ultimate] I'm therefore in favour of applying Ineiev's patch. Bruno