summaryrefslogtreecommitdiff
path: root/devdocs/git/gitformat-signature.html
diff options
context:
space:
mode:
authorCraig Jennings <c@cjennings.net>2025-08-14 22:58:58 -0500
committerCraig Jennings <c@cjennings.net>2025-08-14 22:58:58 -0500
commit82ba818ff456bcd6d56a06226e3f27e98fbb55c3 (patch)
tree158cfc17b2f644a10f063cb546752cfaae12c97f /devdocs/git/gitformat-signature.html
parent9278ddd4ea1a8b1a4c1edaa8894516e3f48d245b (diff)
downloaddotemacs-82ba818ff456bcd6d56a06226e3f27e98fbb55c3.tar.gz
dotemacs-82ba818ff456bcd6d56a06226e3f27e98fbb55c3.zip
removing all downloaded devdocs files
Diffstat (limited to 'devdocs/git/gitformat-signature.html')
-rw-r--r--devdocs/git/gitformat-signature.html123
1 files changed, 0 insertions, 123 deletions
diff --git a/devdocs/git/gitformat-signature.html b/devdocs/git/gitformat-signature.html
deleted file mode 100644
index 8db0a9c5..00000000
--- a/devdocs/git/gitformat-signature.html
+++ /dev/null
@@ -1,123 +0,0 @@
-<h1>gitformat-signature</h1> <h2 id="_name">Name</h2> <div class="sectionbody"> <p>gitformat-signature - Git cryptographic signature formats</p> </div> <h2 id="_synopsis">Synopsis</h2> <div class="sectionbody"> <div class="verseblock"> <pre class="content">&lt;[tag|commit] object header(s)&gt;
-&lt;over-the-wire protocol&gt;</pre> </div> </div> <h2 id="_description">Description</h2> <div class="sectionbody"> <p>Git uses cryptographic signatures in various places, currently objects (tags, commits, mergetags) and transactions (pushes). In every case, the command which is about to create an object or transaction determines a payload from that, calls an external program to obtain a detached signature for the payload (<code>gpg -bsa</code> in the case of PGP signatures), and embeds the signature into the object or transaction.</p> <p>Signatures begin with an "ASCII Armor" header line and end with a tail line, which differ depending on signature type (as selected by <code>gpg.format</code>, see <a href="git-config">git-config[1]</a>). These are, for <code>gpg.format</code> values:</p> <div class="dlist"> <dl> <dt class="hdlist1" id="Documentation/gitformat-signature.txt-codegpgcodePGP"> <code>gpg</code> (PGP) </dt> <dd> <p><code>-----BEGIN PGP SIGNATURE-----</code> and <code>-----END PGP SIGNATURE-----</code>. Or, if gpg is told to produce RFC1991 signatures, <code>-----BEGIN PGP MESSAGE-----</code> and <code>-----END PGP MESSAGE-----</code></p> </dd> <dt class="hdlist1" id="Documentation/gitformat-signature.txt-codesshcodeSSH"> <code>ssh</code> (SSH) </dt> <dd> <p><code>-----BEGIN SSH SIGNATURE-----</code> and <code>-----END SSH SIGNATURE-----</code></p> </dd> <dt class="hdlist1" id="Documentation/gitformat-signature.txt-codex509codeX509"> <code>x509</code> (X.509) </dt> <dd> <p><code>-----BEGIN SIGNED MESSAGE-----</code> and <code>-----END SIGNED MESSAGE-----</code></p> </dd> </dl> </div> <p>Signatures sometimes appear as a part of the normal payload (e.g. a signed tag has the signature block appended after the payload that the signature applies to), and sometimes appear in the value of an object header (e.g. a merge commit that merged a signed tag would have the entire tag contents on its "mergetag" header). In the case of the latter, the usual multi-line formatting rule for object headers applies. I.e. the second and subsequent lines are prefixed with a SP to signal that the line is continued from the previous line.</p> <p>This is even true for an originally empty line. In the following examples, the end of line that ends with a whitespace letter is highlighted with a <code>$</code> sign; if you are trying to recreate these example by hand, do not cut and paste them—​they are there primarily to highlight extra whitespace at the end of some lines.</p> <p>The signed payload and the way the signature is embedded depends on the type of the object resp. transaction.</p> </div> <h2 id="_tag_signatures">Tag signatures</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>created by: <code>git tag -s</code></p> </li> <li> <p>payload: annotated tag object</p> </li> <li> <p>embedding: append the signature to the unsigned tag object</p> </li> <li> <p>example: tag <code>signedtag</code> with subject <code>signed tag</code></p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>object 04b871796dc0420f8e7561a895b52484b701d51a
-type commit
-tag signedtag
-tagger C O Mitter &lt;committer@example.com&gt; 1465981006 +0000
-
-signed tag
-
-signed tag message body
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1
-
-iQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn
-rxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh
-8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods
-q8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0
-rkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x
-lZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E=
-=jpXa
------END PGP SIGNATURE-----</pre> </div> </div> <div class="ulist"> <ul> <li> <p>verify with: <code>git verify-tag [-v]</code> or <code>git tag -v</code></p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>gpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189
-gpg: Good signature from "Eris Discordia &lt;discord@example.net&gt;"
-gpg: WARNING: This key is not certified with a trusted signature!
-gpg: There is no indication that the signature belongs to the owner.
-Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189
-object 04b871796dc0420f8e7561a895b52484b701d51a
-type commit
-tag signedtag
-tagger C O Mitter &lt;committer@example.com&gt; 1465981006 +0000
-
-signed tag
-
-signed tag message body</pre> </div> </div> </div> <h2 id="_commit_signatures">Commit signatures</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>created by: <code>git commit -S</code></p> </li> <li> <p>payload: commit object</p> </li> <li> <p>embedding: header entry <code>gpgsig</code> (content is preceded by a space)</p> </li> <li> <p>example: commit with subject <code>signed commit</code></p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>tree eebfed94e75e7760540d1485c740902590a00332
-parent 04b871796dc0420f8e7561a895b52484b701d51a
-author A U Thor &lt;author@example.com&gt; 1465981137 +0000
-committer C O Mitter &lt;committer@example.com&gt; 1465981137 +0000
-gpgsig -----BEGIN PGP SIGNATURE-----
- Version: GnuPG v1
- $
- iQEcBAABAgAGBQJXYRjRAAoJEGEJLoW3InGJ3IwIAIY4SA6GxY3BjL60YyvsJPh/
- HRCJwH+w7wt3Yc/9/bW2F+gF72kdHOOs2jfv+OZhq0q4OAN6fvVSczISY/82LpS7
- DVdMQj2/YcHDT4xrDNBnXnviDO9G7am/9OE77kEbXrp7QPxvhjkicHNwy2rEflAA
- zn075rtEERDHr8nRYiDh8eVrefSO7D+bdQ7gv+7GsYMsd2auJWi1dHOSfTr9HIF4
- HJhWXT9d2f8W+diRYXGh4X0wYiGg6na/soXc+vdtDYBzIxanRqjg8jCAeo1eOTk1
- EdTwhcTZlI0x5pvJ3H0+4hA2jtldVtmPM4OTB0cTrEWBad7XV6YgiyuII73Ve3I=
- =jKHM
- -----END PGP SIGNATURE-----
-
-signed commit
-
-signed commit message body</pre> </div> </div> <div class="ulist"> <ul> <li> <p>verify with: <code>git verify-commit [-v]</code> (or <code>git show --show-signature</code>)</p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>gpg: Signature made Wed Jun 15 10:58:57 2016 CEST using RSA key ID B7227189
-gpg: Good signature from "Eris Discordia &lt;discord@example.net&gt;"
-gpg: WARNING: This key is not certified with a trusted signature!
-gpg: There is no indication that the signature belongs to the owner.
-Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189
-tree eebfed94e75e7760540d1485c740902590a00332
-parent 04b871796dc0420f8e7561a895b52484b701d51a
-author A U Thor &lt;author@example.com&gt; 1465981137 +0000
-committer C O Mitter &lt;committer@example.com&gt; 1465981137 +0000
-
-signed commit
-
-signed commit message body</pre> </div> </div> </div> <h2 id="_mergetag_signatures">Mergetag signatures</h2> <div class="sectionbody"> <div class="ulist"> <ul> <li> <p>created by: <code>git merge</code> on signed tag</p> </li> <li> <p>payload/embedding: the whole signed tag object is embedded into the (merge) commit object as header entry <code>mergetag</code></p> </li> <li> <p>example: merge of the signed tag <code>signedtag</code> as above</p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>tree c7b1cff039a93f3600a1d18b82d26688668c7dea
-parent c33429be94b5f2d3ee9b0adad223f877f174b05d
-parent 04b871796dc0420f8e7561a895b52484b701d51a
-author A U Thor &lt;author@example.com&gt; 1465982009 +0000
-committer C O Mitter &lt;committer@example.com&gt; 1465982009 +0000
-mergetag object 04b871796dc0420f8e7561a895b52484b701d51a
- type commit
- tag signedtag
- tagger C O Mitter &lt;committer@example.com&gt; 1465981006 +0000
- $
- signed tag
- $
- signed tag message body
- -----BEGIN PGP SIGNATURE-----
- Version: GnuPG v1
- $
- iQEcBAABAgAGBQJXYRhOAAoJEGEJLoW3InGJklkIAIcnhL7RwEb/+QeX9enkXhxn
- rxfdqrvWd1K80sl2TOt8Bg/NYwrUBw/RWJ+sg/hhHp4WtvE1HDGHlkEz3y11Lkuh
- 8tSxS3qKTxXUGozyPGuE90sJfExhZlW4knIQ1wt/yWqM+33E9pN4hzPqLwyrdods
- q8FWEqPPUbSJXoMbRPw04S5jrLtZSsUWbRYjmJCHzlhSfFWW4eFd37uquIaLUBS0
- rkC3Jrx7420jkIpgFcTI2s60uhSQLzgcCwdA2ukSYIRnjg/zDkj8+3h/GaROJ72x
- lZyI6HWixKJkWw8lE9aAOD9TmTW9sFJwcVAzmAuFX2kUreDUKMZduGcoRYGpD7E=
- =jpXa
- -----END PGP SIGNATURE-----
-
-Merge tag 'signedtag' into downstream
-
-signed tag
-
-signed tag message body
-
-# gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189
-# gpg: Good signature from "Eris Discordia &lt;discord@example.net&gt;"
-# gpg: WARNING: This key is not certified with a trusted signature!
-# gpg: There is no indication that the signature belongs to the owner.
-# Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189</pre> </div> </div> <div class="ulist"> <ul> <li> <p>verify with: verification is embedded in merge commit message by default, alternatively with <code>git show --show-signature</code>:</p> </li> </ul> </div> <div class="listingblock"> <div class="content"> <pre>commit 9863f0c76ff78712b6800e199a46aa56afbcbd49
-merged tag 'signedtag'
-gpg: Signature made Wed Jun 15 10:56:46 2016 CEST using RSA key ID B7227189
-gpg: Good signature from "Eris Discordia &lt;discord@example.net&gt;"
-gpg: WARNING: This key is not certified with a trusted signature!
-gpg: There is no indication that the signature belongs to the owner.
-Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189
-Merge: c33429b 04b8717
-Author: A U Thor &lt;author@example.com&gt;
-Date: Wed Jun 15 09:13:29 2016 +0000
-
- Merge tag 'signedtag' into downstream
-
- signed tag
-
- signed tag message body
-
- # gpg: Signature made Wed Jun 15 08:56:46 2016 UTC using RSA key ID B7227189
- # gpg: Good signature from "Eris Discordia &lt;discord@example.net&gt;"
- # gpg: WARNING: This key is not certified with a trusted signature!
- # gpg: There is no indication that the signature belongs to the owner.
- # Primary key fingerprint: D4BE 2231 1AD3 131E 5EDA 29A4 6109 2E85 B722 7189</pre> </div> </div> </div><div class="_attribution">
- <p class="_attribution-p">
- &copy; 2012&ndash;2024 Scott Chacon and others<br>Licensed under the MIT License.<br>
- <a href="https://git-scm.com/docs/gitformat-signature" class="_attribution-link">https://git-scm.com/docs/gitformat-signature</a>
- </p>
-</div>