Paul Eggert wrote:
> > -  gpg --verify $tarballs[0].sig
> > +  gpg --verify $tarballs[0].sig $tarballs[0]
> 
> Why is this an improvement? You mention the case of a non-detached signature, 
> but if the .sig file is (mistakenly) non-detached, why would adding 
> $tarballs[0] change gpg's behavior? Won't gpg verify $tarballs[0].sig and 
> ignore $tarballs[0]?
> 
> > gpg emits a warning when it's absent, like
> > 
> >   gpg: assuming signed data in 'file.tar.gz'
> 
> As I understand it, that line is merely informational; it's not a warning.

Yes, but it's clutter. See:

$ gpg --verify gettext-1.0.tar.lz.sig
gpg: assuming signed data in 'gettext-1.0.tar.lz'
gpg: Signature made Do 29 Jan 2026 01:14:03 CET
gpg:                using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08
gpg: Good signature from "Bruno Haible (Free Software Development) 
<[email protected]>" [ultimate]

$ gpg --verify gettext-1.0.tar.lz.sig gettext-1.0.tar.lz
gpg: Signature made Do 29 Jan 2026 01:14:03 CET
gpg:                using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08
gpg: Good signature from "Bruno Haible (Free Software Development) 
<[email protected]>" [ultimate]

> If the warning is annoying, perhaps we should use gpg's --quiet option?

The --quiet option has no effect here:

$ gpg --verify --quiet gettext-1.0.tar.lz.sig 
gpg: assuming signed data in 'gettext-1.0.tar.lz'
gpg: Signature made Do 29 Jan 2026 01:14:03 CET
gpg:                using EDDSA key E0FFBD975397F77A32AB76ECB6301D9E1BBEAC08
gpg: Good signature from "Bruno Haible (Free Software Development) 
<[email protected]>" [ultimate]

I'm therefore in favour of applying Ineiev's patch.

Bruno




Reply via email to