Communities

The Great Outdoors

Photography & Video

Scientific Speculation

Electrical Engineering

Languages & Linguistics

Software Development

Community Proposals

tag:snake search within a tag

answers:0 unanswered questions

user:xxxx search by author id

score:0.5 posts with 0.5+ score

"snake oil" exact phrase

votes:4 posts with 4+ votes

created:<1w created < 1 week ago

post_type:xxxx type of post

Notifications

Mark all as read See all your notifications »

Q&A Code Reviews Meta

Q&A

Posts Tags Edits

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Comments on PGP sign emails sent with git-send-email(1)

Parent

PGP sign emails sent with git-send-email(1)

+7

−0

How can we use git-send-email(1) to sign patches (emails) with the gpg(1) keyring?

I've heard it can be done, but couldn't find anything in the git-send-email(1) documentation nor in a web search.

git email pgp signing

posted almost 2 years ago

CC BY-SA 4.0

2y ago by Alexei‭

452 reputation 13 7 77 109

Raw

Markdown

is a duplicate

This question has been asked before and has already been answered. It should be marked as a duplicate.

Please enter the URL of the proposed duplicate in the details field below.

not constructive

This question cannot be answered in a way that is helpful to anyone. It's not possible to learn something from possible answers, except for the solution for the specific problem of the asker.

0 comment threads

Post

+4

−0

How can we use git-send-email(1) to sign patches (emails) with the gpg(1) keyring?

The git-send-email command does not have any CLI options to perform cryptographic operations, so, to the best of my knowledge, you cannot really tell it to sign anything.

What you can do is sign commits with a GPG key using git commit -S after telling Git which key it should use, but these are commits, not patches or emails. In addition, this is only good for the repository into which the commits are made. When you use git format-patch, the GPG signature is not part of the *.patch files themselves (which is unfortunate).

The only alternatives off the top of my head are:

manually send an email that is both encrypted (with your recipient's public GPG key) and signed (with your GPG private key) where you include the *.patch files as attachments; or
tell the other person to directly git fetch or git pull from your branch where the GPG signed commits can be found; or
rely on the "web of trust" principle where, in short, you accept patches only from people that you trust (i.e. how Linux kernel development is typically done).

Unfortunately, this means you're not really using git-send-email at this point, which is not what you originally wanted, but I hope at least one of the alternatives above can work for you.

posted almost 2 years ago

CC BY-SA 4.0

2y ago

ghost-in-the-zsh‭

670 reputation 7 11 84 39

Copy Link

Raw

Markdown

2 comment threads

Fourth option (though probably not practical). (2 comments)

3. web of trust (3 comments)

alx‭ wrote almost 2 years ago · edited almost 2 years ago

Considering that I'm asking this for use in a public mailing list, option 1 is not possible, option 2 defeats the simplicity and versatility of email patches, so option 3 remains.

In fact, yes, a web of trust is what I was looking for (accept more or less blindly patches from specific persons, then do thorough review of anyone else). But I still have a problem: how do I know the emails come from who says is the sender, without a PGP signature on the email? Anyone can send an email claiming it to be from foo@example.com without any authentication, right?

ghost-in-the-zsh‭ wrote almost 2 years ago

option 1 is not possible

You could simply sign your email and send it without encrypting it. That would at least allow you to prove that you really did send the email.

how do I know the emails come from who says is the sender, without a PGP signature on the email?

You don't, in the sense that you don't have an actual proof. The proof would be the signature, which you assume you don't have.

Anyone can send an email claiming it to be from foo@example.com without any authentication, right?

Well, yes, in theory. In practice, I don't think that would be very effective or successful for at least 1 reason: chances are that there will be some back-n-forth when discussing the patch(es), so when you reply to the email and the real sender gets the email that s/he didn't send, the fact someone was impersonated would be obvious. Also, most people aren't the big targets they imagine themselves to be - and if they are, they'll have what they need to protect themselves, etc.

alx‭ wrote 4 days ago

If such a malicious sender uses the Reply-To header field, as in this example:

From: well-known@example.com
Reply-To: well-known@foo.com

That reply-to address may look like a valid alternative address of the sender, and really be an address of an attacker.

As long as the impersonated person is not subscribed to the mailing list, that's likely going to go unnoticed.

Re: big targets: Hmmm, I would reconsider that after the xz backdoor.