Re: [BUG] Veryfing signatures in git log fails when language is not english

From: Junio C Hamano <gitster@pobox.com>
To: Mariusz Gronczewski <xani666@gmail.com>
Cc: Michael J Gruber <git@drmicha.warpmail.net>, git@vger.kernel.org
Subject: Re: [BUG] Veryfing signatures in git log fails when language is not english
Date: Fri, 15 Feb 2013 08:08:54 -0800	[thread overview]
Message-ID: <7vip5twodl.fsf@alter.siamese.dyndns.org> (raw)
In-Reply-To: <CAJ9Ak2oF+SiYjStJndRZqLfnzBisn3TyXr3U_E_42BHrKbKPfQ@mail.gmail.com> (Mariusz Gronczewski's message of "Fri, 15 Feb 2013 15:14:47 +0100")

Mariusz Gronczewski <xani666@gmail.com> writes:

> 2013/2/14 Junio C Hamano <gitster@pobox.com>:
>>
>>     - The "right" one you mention for %GS is easier than you might
>>       think.  If you just verify against the accompanying "tagger"
>>       identity, that should be sufficient.  It of course cannot be
>>       generally solved, as you could tag as person A while signing
>>       with key for person B, but a simple social convention would
>>       help us out there: if you tag as Mariusz Gronczewski, your
>>       signature should also say so.
> unless there is someone else with same name, which happens more often
> (so far i've seen it happen twice) than same GPG IDs.

Oh, I didn't mean to say "ignore email part", which of course will
make the result more likely to be ambiguous.

I thought you meant by "have to show right one" the following
scenario:

    The tag v1.8.1 has a GPG signature.  The key 96AFE6CB was used
    to sign it. The key is associated with more than one identities.
    One of them is "Junio C Hamano <gitster@pobox.com>", but that is
    not the only one.  I also have combinations of other e-mail
    addresses and names spelled differently (e.g. "Junio Hamano
    <jchXXXX@gmail.com>") that are _not_ associated with that key.

    GPG may say "good signature from A aka B aka C"; which one of A,
    B, or C should we choose?

I was suggesting that among the identities associated with the key
used to sign the tag, we should show the one that matches the
identity on the tagger field.

    object 5d417842efeafb6e109db7574196901c4e95d273
    type commit
    tag v1.8.1
    tagger Junio C Hamano <gitster@pobox.com> 1356992771 -0800

    Git 1.8.1
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.10 (GNU/Linux)

    iQIc...
    =v706
    -----END PGP SIGNATURE-----

Because it is clear from the context where the signature appears
that that identity is what matters for me as a signer in the project
the tag appears in.

I may have other e-mail addresses that are not associated with that
key, but it would be insane to put that on the tagger field of the
tag, while GPG-signing with that key.