PGP sign emails sent with git-send-email(1)
2 answers
How can we use git-send-email(1) to sign patches (emails) with the gpg(1) keyring?
The git-send-email
command does not have any CLI options to perform cryptographic operations, so, to the best of my knowledge, you cannot really tell it to sign anything.
What you can do is sign commits with a GPG key using git commit -S
after telling Git which key it should use, but these are commits, not patches or emails. In addition, this is only good for the repository into which the commits are made. When you use git format-patch
, the GPG signature is not part of the *.patch
files themselves (which is unfortunate).
The only alternatives off the top of my head are:
- manually send an email that is both encrypted (with your recipient's public GPG key) and signed (with your GPG private key) where you include the
*.patch
files as attachments; or - tell the other person to directly
git fetch
orgit pull
from your branch where the GPG signed commits can be found; or - rely on the "web of trust" principle where, in short, you accept patches only from people that you trust (i.e. how Linux kernel development is typically done).
Unfortunately, this means you're not really using git-send-email
at this point, which is not what you originally wanted, but I hope at least one of the alternatives above can work for you.
2 comment threads
The following users marked this post as Works for me:
User | Comment | Date |
---|---|---|
alx | (no comment) | Jun 17, 2022 at 14:33 |
It can't be done with git-send-email
(1), but there's a tool that integrates with it, and is very simple to use: patatt
(1).
Install the tool:
$ sudo apt-get install patatt
And then for each repo in which you want to sign patches, run:
$ cd /some/git/repo/
$ patatt install-hook
If you have a gpg
(1) keyring, and .gitconfig
knows about it:
[user]
name = Alejandro Colomar
email = alx.manpages@gmail.com
signingKey = A9348594CE31283A826FBDD8D57633D441E25BB5
Then you're done. Just use git-format-patch
(1) and git-send-email
(1) as always, and patches will be signed.
To validate a patch before appying it:
$ patatt validate /path/to/incoming.patch
If the patch contains a signature, it will print a human-readable message telling if the signautre is good (and also return 0) or bad (and also return non-zero), according to your keyring and the patch contents. If there's no signature it will print nothing (and return 0).
Then you can git-am
(1) as always, with confidence.
See also: https://lore.kernel.org/git/81caab7d-777e-13fe-89ea-820b7b2f0314@gmail.com/T/
Source code: https://git.kernel.org/pub/scm/utils/patatt/patatt.git
0 comment threads