On Sat, Aug 22, 2026 at 10:09:27AM -0700, Paul Eggert wrote: > On 2026-08-22 08:53, Ineiev wrote: > > - gpg --verify $tarballs[0].sig > > + gpg --verify $tarballs[0].sig $tarballs[0] > > Why is this an improvement? You mention the case of a non-detached > signature, but if the .sig file is (mistakenly) non-detached, why > would adding $tarballs[0] change gpg's behavior? Won't gpg verify > $tarballs[0].sig and ignore $tarballs[0]?
Yes, it will (although with a warning in recent GnuPG versions when
$tarballs[0] is present), and then the integrity of $tarballs[0]
is not checked; gpg --verify $tarballs[0]{.sig,} will fail saying,
gpg: not a detached signature
signature.asc
Description: PGP signature
