Re: build-aux/announce-gen: amending gpg --verify command line
Ineiev <[email protected]>
| Newsgroups | gmane.comp.lib.gnulib.bugs |
|---|---|
| Message-ID | <aonjAVHXpmk/0z7P@manas> |
On Sat, Aug 22, 2026 at 10:09:27AM -0700, Paul Eggert wrote:
> On 2026-08-22 08:53, Ineiev wrote:
> > - gpg --verify $tarballs[0].sig
> > + gpg --verify $tarballs[0].sig $tarballs[0]
>
> Why is this an improvement? You mention the case of a non-detached
> signature, but if the .sig file is (mistakenly) non-detached, why
> would adding $tarballs[0] change gpg's behavior? Won't gpg verify
> $tarballs[0].sig and ignore $tarballs[0]?
Yes, it will (although with a warning in recent GnuPG versions when
$tarballs[0] is present), and then the integrity of $tarballs[0]
is not checked; gpg --verify $tarballs[0]{.sig,} will fail saying,
gpg: not a detached signature
signature.asc
(application/pgp-signature, 525 B)
-----BEGIN PGP SIGNATURE----- iQFPBAEBCAA5FiEEvZ1N7nsv8cvvLuDE4KzT4Mvnh0oFAmqJ4vwbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEOCs0+DL54dKuo8H/13gfngBU6KiITtQi6HE royaJGLAd/IOAYtCLf7VzVAraaQaNg7vme+RZtP//ccHIwN7wfynJefl+V3mHZ7D p+tGuuOWwWw79ea3H87b8uCYwEAwsDy4wXI/CWvxJYom/jbU35FkP1WkkS/Qd6H1 gTIVOAU+LmKovGjN6NYyHyj7j1ZD6DBKDBc0B3Qxip2KytDlmmFi2HDua/hGbFv1 JYJvjohFk98dbVgSNcurFuowZq4qO4g2XdlUgy7g25NSlCJKd9IIZavuwOonD98w N+DjjVj8+XufLd+piYNx980KtvQgcJPwErjW/Gs2JW/B0JzhPj2Z44jIKVeXf+4e tWE= =bXPU -----END PGP SIGNATURE-----