On 2026-08-22 08:53, Ineiev wrote:
- gpg --verify $tarballs[0].sig + gpg --verify $tarballs[0].sig $tarballs[0]
Why is this an improvement? You mention the case of a non-detached signature, but if the .sig file is (mistakenly) non-detached, why would adding $tarballs[0] change gpg's behavior? Won't gpg verify $tarballs[0].sig and ignore $tarballs[0]?
gpg emits a warning when it's absent, like gpg: assuming signed data in 'file.tar.gz'
As I understand it, that line is merely informational; it's not a warning. If the warning is annoying, perhaps we should use gpg's --quiet option?
