Communities

Writing
Writing
Codidact Meta
Codidact Meta
The Great Outdoors
The Great Outdoors
Photography & Video
Photography & Video
Scientific Speculation
Scientific Speculation
Cooking
Cooking
Electrical Engineering
Electrical Engineering
Judaism
Judaism
Languages & Linguistics
Languages & Linguistics
Software Development
Software Development
Mathematics
Mathematics
Christianity
Christianity
Code Golf
Code Golf
Music
Music
Physics
Physics
Linux Systems
Linux Systems
Power Users
Power Users
Tabletop RPGs
Tabletop RPGs
Community Proposals
Community Proposals
tag:snake search within a tag
answers:0 unanswered questions
user:xxxx search by author id
score:0.5 posts with 0.5+ score
"snake oil" exact phrase
votes:4 posts with 4+ votes
created:<1w created < 1 week ago
post_type:xxxx type of post
Search help
Notifications
Mark all as read See all your notifications »
Q&A

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

PGP sign emails sent with git-send-email(1)

+7
−0

How can we use git-send-email(1) to sign patches (emails) with the gpg(1) keyring?

I've heard it can be done, but couldn't find anything in the git-send-email(1) documentation nor in a web search.

History
Why does this post require moderator attention?
You might want to add some details to your flag.
Why should this post be closed?

0 comment threads

3 answers

+4
−0

How can we use git-send-email(1) to sign patches (emails) with the gpg(1) keyring?

The git-send-email command does not have any CLI options to perform cryptographic operations, so, to the best of my knowledge, you cannot really tell it to sign anything.

What you can do is sign commits with a GPG key using git commit -S after telling Git which key it should use, but these are commits, not patches or emails. In addition, this is only good for the repository into which the commits are made. When you use git format-patch, the GPG signature is not part of the *.patch files themselves (which is unfortunate).

The only alternatives off the top of my head are:

  1. manually send an email that is both encrypted (with your recipient's public GPG key) and signed (with your GPG private key) where you include the *.patch files as attachments; or
  2. tell the other person to directly git fetch or git pull from your branch where the GPG signed commits can be found; or
  3. rely on the "web of trust" principle where, in short, you accept patches only from people that you trust (i.e. how Linux kernel development is typically done).

Unfortunately, this means you're not really using git-send-email at this point, which is not what you originally wanted, but I hope at least one of the alternatives above can work for you.

History
Why does this post require moderator attention?
You might want to add some details to your flag.

2 comment threads

3. web of trust (5 comments)
Fourth option (though probably not practical). (2 comments)
+2
−0

It can't be done with git-send-email(1), but there's a tool that integrates with it, and is very simple to use: patatt(1).

Install the tool:

$ sudo apt-get install patatt

And then for each repo in which you want to sign patches, run:

$ cd /some/git/repo/
$ patatt install-hook

If you have a gpg(1) keyring, and .gitconfig knows about it:

[user]
	name = Alejandro Colomar
	email = alx.manpages@gmail.com
	signingKey = A9348594CE31283A826FBDD8D57633D441E25BB5

Then you're done. Just use git-format-patch(1) and git-send-email(1) as always, and patches will be signed.

To validate a patch before appying it:

$ patatt validate /path/to/incoming.patch

If the patch contains a signature, it will print a human-readable message telling if the signautre is good (and also return 0) or bad (and also return non-zero), according to your keyring and the patch contents. If there's no signature it will print nothing (and return 0).

Then you can git-am(1) as always, with confidence.


See also: https://lore.kernel.org/git/81caab7d-777e-13fe-89ea-820b7b2f0314@gmail.com/T/

Source code: https://git.kernel.org/pub/scm/utils/patatt/patatt.git

History
Why does this post require moderator attention?
You might want to add some details to your flag.

1 comment thread

Thank you so much (2 comments)
+0
−0

git-send-email(1) uses sendmail(8) as the MTA by default. However, this can be changed by passing the --sendmail-cmd option.

$ man git-send-email | sed -n '/--sendmail-cmd=/,/^$/p'
     --sendmail-cmd=<command>
         Specify a command to run to send the email. The command should
         be sendmail-like; specifically, it must support the -i option.
         The command will be executed in the shell if necessary.
         Default is the value of sendemail.sendmailcmd. If unspecified,
         and if --smtp-server is also unspecified, git-send-email will
         search for sendmail in /usr/sbin, /usr/lib and $PATH.

or the equivalent, sendemail.sendmailcmd, in git-config(1).

A MUA program like neomutt(1) can be used for this purpose:

[sendemail]
	sendmailcmd = neomutt -C -H - && true

The && true trick is to ignore the arguments that git-send-mail(1) passes to the MTA, which neomutt(1) doesn't need. The -C flag was added (disclaimer: I did that) to neomutt(1) recently to allow using crypto when running in batch mode (reading from stdin), which is disabled by default.

This has other benefits, like not having to configure [sendemail] for git-send-email(1) if you already have neomutt(1) configured.

See also: https://neomutt.org/feature/cli-crypto

History
Why does this post require moderator attention?
You might want to add some details to your flag.

0 comment threads

Sign up to answer this question »