Git uses wrong subkey for signing commits with GPG key

Git uses wrong subkey for signing commits with GPG key

[Andrzej Ośmiałowski]

I have an issue with git and signing commits with GPG subkey.

My setup:
- master key used for certification only
- subkey for my main workstation
- subkey for my mobile workstation (a notebook).

Both subkeys are used for signing only.

I've configured git to use my specific subkey however it does not
work: git config --global user.signingkey = KEYID. Every commit is
being signed using the newest subkey. I've verified the same behavior
on three systems (although with the same setup). I've tried to use
--gpg-sign=KEYID flag, but it does not work either.

Environment:
OS: Archlinux
Shell: ZSH
GPG: 2.2.4
Git: 2.15.1.

Is there any other info I shall provide?

Re: Git uses wrong subkey for signing commits with GPG key

[Todd Zullinger]

Hi Andrzej,

Andrzej Ośmiałowski wrote:
> I have an issue with git and signing commits with GPG subkey.
> 
> My setup:
> - master key used for certification only
> - subkey for my main workstation
> - subkey for my mobile workstation (a notebook).
> 
> Both subkeys are used for signing only.
> 
> I've configured git to use my specific subkey however it does not
> work: git config --global user.signingkey = KEYID. Every commit is
> being signed using the newest subkey. I've verified the same behavior
> on three systems (although with the same setup). I've tried to use
> --gpg-sign=KEYID flag, but it does not work either.

I could be wrong, but I think you need to append '!' to
KEYID to force gpg to use that specific signing subkey.

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A vacuum is a hell of a lot better than some of the stuff that nature
replaces it with.
    -- Tennessee Williams

Re: Git uses wrong subkey for signing commits with GPG key

[Andrzej Ośmiałowski]

Hi Todd,

On Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:
> Hi Andrzej,
>
> Andrzej Ośmiałowski wrote:
>> I have an issue with git and signing commits with GPG subkey.
>>
>> My setup:
>> - master key used for certification only
>> - subkey for my main workstation
>> - subkey for my mobile workstation (a notebook).
>>
>> Both subkeys are used for signing only.
>>
>> I've configured git to use my specific subkey however it does not
>> work: git config --global user.signingkey = KEYID. Every commit is
>> being signed using the newest subkey. I've verified the same behavior
>> on three systems (although with the same setup). I've tried to use
>> --gpg-sign=KEYID flag, but it does not work either.
>
> I could be wrong, but I think you need to append '!' to
> KEYID to force gpg to use that specific signing subkey.
>
> --
> Todd
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> A vacuum is a hell of a lot better than some of the stuff that nature
> replaces it with.
>     -- Tennessee Williams
>

thanks for reply. You just solved my issue. I will prepare a PR to the
docs to add relevant information.

Re: Git uses wrong subkey for signing commits with GPG key

[Todd Zullinger]

Andrzej Ośmiałowski wrote:
> On Sat, Jan 13, 2018 at 1:22 AM, Todd Zullinger <tmz@pobox.com> wrote:
>> I could be wrong, but I think you need to append '!' to
>> KEYID to force gpg to use that specific signing subkey.
[...]
> thanks for reply. You just solved my issue. I will prepare a PR to the
> docs to add relevant information.

Glad it helped.  The git-tag documentation points to
git-config and the user.signingKey variable in the
CONFIGURATION section.  The git-config documentation for
that variable currently says:

    If linkgit:git-tag[1] or linkgit:git-commit[1] is not selecting the
    key you want it to automatically when creating a signed tag or
    commit, you can override the default selection with this variable.
    This option is passed unchanged to gpg's --local-user parameter,
    so you may specify a key using any method that gpg supports.

Whether that can be improved without being too verbose (or
duplicating too much of the gpg documentation), I don't
know.

Maybe it could point to the gpg documentation, though that
can be in gpg(1), gpg1(1), or gpg2(1), depending on how
their system installs gpg.

The online link covering the many formats that gpg accepts
for the --local-user (-u) option is:

    https://www.gnupg.org/documentation/manuals/gnupg/Specify-a-User-ID.html

-- 
Todd
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It is impossible to enjoy idling thoroughly unless one has plenty of
work to do.
    -- Jerome K. Jerome

Re: Git uses wrong subkey for signing commits with GPG key

[Junio C Hamano]

Todd Zullinger <tmz@pobox.com> writes:

> Glad it helped.  The git-tag documentation points to
> git-config and the user.signingKey variable in the
> CONFIGURATION section.  The git-config documentation for
> that variable currently says:
> ...
>     so you may specify a key using any method that gpg supports.
>
> Whether that can be improved without being too verbose (or
> duplicating too much of the gpg documentation), I don't
> know.

Yeah, I personally do not want to see Git's documentation sound more
autoritative than it actually is wrt how to use software from other
people, especially given that we do not have volunteers who will
closely be keeping track of their changes in order to update our
documentation.  So "any method that gpg supports" is a good place to
stop from that point of view.  "See documentation for the version of
PGP software you use for details." is not a bad thing to add without
risking to go stale, though.