GNU bug report logs - #41941
Signing git commits with PGP fails

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 41941 in the body.
You can then email your comments to 41941 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
To: bug-guix <bug-guix <at> gnu.org>
Subject: Signing git commits with PGP fails
Date: Fri, 19 Jun 2020 00:35:09 +0200

I have a strange error/problem with signing git commits with PGP.

Following situation

`git` is installed via system configuration
`git:send-email` via `guix install` into the user profile

~/.gitconfig has
```
[commit]
  gpgsign = true
```

but trying to sign a git commit fails:
```
git commit -m "test"
error: gpg failed to sign the data
fatal: failed to write commit object
```

`guix remove git:send-email` does not help, still the same.
`guix install git` also doesn't help.

What is wrong here?

P.S: As long as commit signing is not working I cannot become a commiter
to the repo. Marius and Ricardo already pledged their support :P

Message #8 received at 41941 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
Cc: 41941 <at> debbugs.gnu.org
Subject: Re: bug#41941: Signing git commits with PGP fails
Date: Thu, 18 Jun 2020 21:52:47 -0400

On Fri, Jun 19, 2020 at 12:35:09AM +0200, Jonathan Brielmaier wrote:
> I have a strange error/problem with signing git commits with PGP.

The setup can be complicated...

> Following situation
> 
> `git` is installed via system configuration
> `git:send-email` via `guix install` into the user profile
> 
> ~/.gitconfig has
> ```
> [commit]
>   gpgsign = true
> ```

I also have:

------
[gpg]
        program = gpg 
[user]
        signingkey = B0515948F1E7D3C1B98038A02646FA30BACA7F08
------

> but trying to sign a git commit fails:
> ```
> git commit -m "test"
> error: gpg failed to sign the data
> fatal: failed to write commit object
> ```

Do you also have a GPG pinentry program installed? Are you able to sign
an arbitrary file with GPG, outside of Git? For example:

$ gpg --output test.sig --sign file

Message #11 received at 41941 <at> debbugs.gnu.org (full text, mbox):

From: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
To: Leo Famulari <leo <at> famulari.name>
Cc: 41941 <at> debbugs.gnu.org
Subject: Re: bug#41941: Signing git commits with PGP fails
Date: Fri, 19 Jun 2020 16:43:10 +0200

On 19.06.20 03:52, Leo Famulari wrote:
> On Fri, Jun 19, 2020 at 12:35:09AM +0200, Jonathan Brielmaier wrote:
>> I have a strange error/problem with signing git commits with PGP.
>
> The setup can be complicated...
>
>> Following situation
>>
>> `git` is installed via system configuration
>> `git:send-email` via `guix install` into the user profile
>>
>> ~/.gitconfig has
>> ```
>> [commit]
>>   gpgsign = true
>> ```
>
> I also have:
>
> ------
> [gpg]
>         program = gpg
> [user]
>         signingkey = B0515948F1E7D3C1B98038A02646FA30BACA7F08
> ------

Oke, the signingkey parameter is also present in my config.

>> but trying to sign a git commit fails:
>> ```
>> git commit -m "test"
>> error: gpg failed to sign the data
>> fatal: failed to write commit object
>> ```
>
> Do you also have a GPG pinentry program installed? Are you able to sign
> an arbitrary file with GPG, outside of Git? For example:
>
> $ gpg --output test.sig --sign file

I have pinentry installed from the config.scm, but it's still
```
gpg --output test.sig --sign TODO.md
gpg: signing failed: No pinentry
gpg: signing failed: No pinentry
```
Do I need an additional service?

Message #14 received at 41941 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
Cc: 41941 <at> debbugs.gnu.org
Subject: Re: bug#41941: Signing git commits with PGP fails
Date: Fri, 19 Jun 2020 12:17:54 -0400

[Message part 1 (text/plain, inline)]

On Fri, Jun 19, 2020 at 04:43:10PM +0200, Jonathan Brielmaier wrote:
> I have pinentry installed from the config.scm, but it's still
> [...]
> gpg: signing failed: No pinentry

I think the root of the problem is that GPG can't find pinentry.

With Guix, it should work automatically if you install GPG and a
pinentry to your user's profile. [0]

When installed via config.scm, you should set "pinentry-program" with
the right path, either on gpg-agent's command line or in
~/.gnupg/gpg-agent.conf.

[0] See 'gnu/packages/patches/gnupg-default-pinentry.patch' of commit
e5b44b06b3f, which fixed a longstanding UX bug

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 41941 <at> debbugs.gnu.org (full text, mbox):

From: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
To: Leo Famulari <leo <at> famulari.name>
Cc: 41941 <at> debbugs.gnu.org
Subject: Re: bug#41941: Signing git commits with PGP fails
Date: Fri, 19 Jun 2020 18:42:21 +0200

On 19.06.20 18:17, Leo Famulari wrote:
> On Fri, Jun 19, 2020 at 04:43:10PM +0200, Jonathan Brielmaier wrote:
>> I have pinentry installed from the config.scm, but it's still
>> [...]
>> gpg: signing failed: No pinentry
>
> I think the root of the problem is that GPG can't find pinentry.
>
> With Guix, it should work automatically if you install GPG and a
> pinentry to your user's profile. [0]
>
> When installed via config.scm, you should set "pinentry-program" with
> the right path, either on gpg-agent's command line or in
> ~/.gnupg/gpg-agent.conf.
>
> [0] See 'gnu/packages/patches/gnupg-default-pinentry.patch' of commit
> e5b44b06b3f, which fixed a longstanding UX bug

A already tried that but had a typo
So
```
pinentry-program /run/current-system/profile/bin/pinentry
``` in ~/.gnupg/gpg-agent.conf

I wonder if we can do better here?

Message #20 received at 41941 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>
Cc: 41941 <at> debbugs.gnu.org
Subject: Re: bug#41941: Signing git commits with PGP fails
Date: Fri, 19 Jun 2020 14:13:27 -0400

On Fri, Jun 19, 2020 at 06:42:21PM +0200, Jonathan Brielmaier wrote:
> A already tried that but had a typo
> So
> ```
> pinentry-program /run/current-system/profile/bin/pinentry
> ``` in ~/.gnupg/gpg-agent.conf
> 
> I wonder if we can do better here?

Let us know if you have a suggestion :)

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.