You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
186 lines
6.4 KiB
186 lines
6.4 KiB
Git signature format |
|
==================== |
|
|
|
== Overview |
|
|
|
Git uses cryptographic signatures in various places, currently objects (tags, |
|
commits, mergetags) and transactions (pushes). In every case, the command which |
|
is about to create an object or transaction determines a payload from that, |
|
calls gpg to obtain a detached signature for the payload (`gpg -bsa`) and |
|
embeds the signature into the object or transaction. |
|
|
|
Signatures always begin with `-----BEGIN PGP SIGNATURE-----` |
|
and end with `-----END PGP SIGNATURE-----`, unless gpg is told to |
|
produce RFC1991 signatures which use `MESSAGE` instead of `SIGNATURE`. |
|
|
|
The signed payload and the way the signature is embedded depends |
|
on the type of the object resp. transaction. |
|
|
|
== Tag signatures |
|
|
|
- created by: `git tag -s` |
|
- payload: annotated tag object |
|
- embedding: append the signature to the unsigned tag object |
|
- example: tag `signedtag` with subject `signed tag` |
|
|
|
---- |
|
object 04b871796dc0420f8e7561a895b52484b701d51a |
|
type commit |
|
tag signedtag |
|
tagger C O Mitter <committer@example.com> 1465981006 +0000 |
|
|
|
signed tag |
|
|
|
signed tag message body |
|
-----BEGIN PGP SIGNATURE----- |
|
Version: GnuPG v1 |
|
|
|
iQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn |
|
rxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh |
|
8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods |
|
q8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0 |
|
rkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x |
|
lZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E= |
|
=jpXa |
|
-----END PGP SIGNATURE----- |
|
---- |
|
|
|
- verify with: `git verify-tag [-v]` or `git tag -v` |
|
|
|
---- |
|
gpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189 |
|
gpg: Good signature from "Eris Discordia <discord@example.net>" |
|
gpg: WARNING: This key is not certified with a trusted signature! |
|
gpg: There is no indication that the signature belongs to the owner. |
|
Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 |
|
object 04b871796dc0420f8e7561a895b52484b701d51a |
|
type commit |
|
tag signedtag |
|
tagger C O Mitter <committer@example.com> 1465981006 +0000 |
|
|
|
signed tag |
|
|
|
signed tag message body |
|
---- |
|
|
|
== Commit signatures |
|
|
|
- created by: `git commit -S` |
|
- payload: commit object |
|
- embedding: header entry `gpgsig` |
|
(content is preceded by a space) |
|
- example: commit with subject `signed commit` |
|
|
|
---- |
|
tree eebfed94e75e7760540d1485c740902590a00332 |
|
parent 04b871796dc0420f8e7561a895b52484b701d51a |
|
author A U Thor <author@example.com> 1465981137 +0000 |
|
committer C O Mitter <committer@example.com> 1465981137 +0000 |
|
gpgsig -----BEGIN PGP SIGNATURE----- |
|
Version: GnuPG v1 |
|
|
|
iQEcBAABAgAGBQJXYRjRAAoJEGEJLoW3InGJ3IwIAIY4SA6GxY3BjL60YyvsJPh/ |
|
HRCJwH+w7wt3Yc/9/bW2F+gF72kdHOOs2jfv+OZhq0q4OAN6fvVSczISY/82LpS7 |
|
DVdMQj2/YcHDT4xrDNBnXnviDO9G7am/9OE77kEbXrp7QPxvhjkicHNwy2rEflAA |
|
zn075rtEERDHr8nRYiDh8eVrefSO7D+bdQ7gv+7GsYMsd2auJWi1dHOSfTr9HIF4 |
|
HJhWXT9d2f8W+diRYXGh4X0wYiGg6na/soXc+vdtDYBzIxanRqjg8jCAeo1eOTk1 |
|
EdTwhcTZlI0x5pvJ3H0+4hA2jtldVtmPM4OTB0cTrEWBad7XV6YgiyuII73Ve3I= |
|
=jKHM |
|
-----END PGP SIGNATURE----- |
|
|
|
signed commit |
|
|
|
signed commit message body |
|
---- |
|
|
|
- verify with: `git verify-commit [-v]` (or `git show --show-signature`) |
|
|
|
---- |
|
gpg: Signature made Wed Jun 15 10:58:57 2016 CEST using RSA key ID B7227189 |
|
gpg: Good signature from "Eris Discordia <discord@example.net>" |
|
gpg: WARNING: This key is not certified with a trusted signature! |
|
gpg: There is no indication that the signature belongs to the owner. |
|
Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 |
|
tree eebfed94e75e7760540d1485c740902590a00332 |
|
parent 04b871796dc0420f8e7561a895b52484b701d51a |
|
author A U Thor <author@example.com> 1465981137 +0000 |
|
committer C O Mitter <committer@example.com> 1465981137 +0000 |
|
|
|
signed commit |
|
|
|
signed commit message body |
|
---- |
|
|
|
== Mergetag signatures |
|
|
|
- created by: `git merge` on signed tag |
|
- payload/embedding: the whole signed tag object is embedded into |
|
the (merge) commit object as header entry `mergetag` |
|
- example: merge of the signed tag `signedtag` as above |
|
|
|
---- |
|
tree c7b1cff039a93f3600a1d18b82d26688668c7dea |
|
parent c33429be94b5f2d3ee9b0adad223f877f174b05d |
|
parent 04b871796dc0420f8e7561a895b52484b701d51a |
|
author A U Thor <author@example.com> 1465982009 +0000 |
|
committer C O Mitter <committer@example.com> 1465982009 +0000 |
|
mergetag object 04b871796dc0420f8e7561a895b52484b701d51a |
|
type commit |
|
tag signedtag |
|
tagger C O Mitter <committer@example.com> 1465981006 +0000 |
|
|
|
signed tag |
|
|
|
signed tag message body |
|
-----BEGIN PGP SIGNATURE----- |
|
Version: GnuPG v1 |
|
|
|
iQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn |
|
rxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh |
|
8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods |
|
q8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0 |
|
rkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x |
|
lZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E= |
|
=jpXa |
|
-----END PGP SIGNATURE----- |
|
|
|
Merge tag 'signedtag' into downstream |
|
|
|
signed tag |
|
|
|
signed tag message body |
|
|
|
# gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189 |
|
# gpg: Good signature from "Eris Discordia <discord@example.net>" |
|
# gpg: WARNING: This key is not certified with a trusted signature! |
|
# gpg: There is no indication that the signature belongs to the owner. |
|
# Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 |
|
---- |
|
|
|
- verify with: verification is embedded in merge commit message by default, |
|
alternatively with `git show --show-signature`: |
|
|
|
---- |
|
commit 9863f0c76ff78712b6800e199a46aa56afbcbd49 |
|
merged tag 'signedtag' |
|
gpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189 |
|
gpg: Good signature from "Eris Discordia <discord@example.net>" |
|
gpg: WARNING: This key is not certified with a trusted signature! |
|
gpg: There is no indication that the signature belongs to the owner. |
|
Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 |
|
Merge: c33429b 04b8717 |
|
Author: A U Thor <author@example.com> |
|
Date: Wed Jun 15 09:13:29 2016 +0000 |
|
|
|
Merge tag 'signedtag' into downstream |
|
|
|
signed tag |
|
|
|
signed tag message body |
|
|
|
# gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189 |
|
# gpg: Good signature from "Eris Discordia <discord@example.net>" |
|
# gpg: WARNING: This key is not certified with a trusted signature! |
|
# gpg: There is no indication that the signature belongs to the owner. |
|
# Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189 |
|
----
|
|
|