> Except for proof that the signatures were in fact made with SHA-1. Look, > I'm just trying to understand what's going on. It's not exactly > straightforward.
This is sort of like a LibreOffice user asking detailed questions about why their word processor document is structured the way it is. There are answers, but the answers are highly technical and not really relevant to how you use GnuPG. It's reasonable to ask, "do you really need to go down this rabbit hole?" If you do, then I'm happy to explain GnuPG data structures and internals. But if you don't, I'd like to devote my limited free time to other pursuits. :) > Why do --list-sigs and --check-sigs show different signatures? I'm afraid this answer will seem condescending: I don't mean it to be. This answer is accurate. Different commands show different outputs because they do different things. To list a signature, the only thing GnuPG needs is the signature. If you give me a document with 100 signatures and I ask it to list the signatures, I'll get a hundred signatures back. To check a signature, GnuPG needs the document, the signature, and the public part of the certificate used for signing. If you give me a document with 100 signatures and I only have the public cert for one, GnuPG will report *one* signature check and say "99 signatures went unchecked for lack of a public cert." Different commands show different outputs because they do different things. > Seriously, I don't mean to be a jerk either, but this also means that > gpg has had 26 years to make the output be more consistent and easier > to understand. Yep. If you're saying GnuPG could use some work, everyone here is in agreement. Take a look at our bug tracker sometime. If you know C and cryptographic engineering, things will get better faster if you help. (Also, for the record, I'm not part of the GnuPG development team. I'm just a user. I'm speaking only as a member of the community, not as part of the team.)
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gnupg-users
