Eclipse Community Forums: EGit / JGit » Signing not shown as verified by GitLab

Help

Home

Home » Eclipse Projects » EGit / JGit » Signing not shown as verified by GitLab

Show: Today's Messages :: Show Polls :: Message Navigator

Signing not shown as verified by GitLab [message #1816910]

Mon, 11 November 2019 17:01

Gerard Krupa

Messages: 1
Registered: November 2019

Junior Member

I'm attempting to make a signed commit in GitLab CE. I've correctly set up the user account, added the GPG public key and verified the email. If I use git commit -S, the GitLab UI shows the commit as verified.

If I try making a signed commit with JGit (5.5.1.201910021850-r) GitLab will accept that the commit is signed, shows the correct key ID in the tooltip but lists the commit as unverified (with the tooltip "This commit was signed with an unverified signature"). The code (Kotlin) that I'm using to sign is:

    private fun commitMerge(
        repo: Git,
        project: Project,
        mergeRequest: MergeRequestDetails
    ) =
        repo.commit()
            .setNoVerify(false)
            .setMessage("Merge ${project.id} - ${mergeRequest.description}")
            .setSign(true)
            .setSigningKey(signingKey).apply {
                setCredentialsProvider(passphraseCredentialsProvider)
            }.call()

Is there something I'm missing or just something that BouncyCastle does differently to the git CLI?

Report message to a moderator

Re: Signing not shown as verified by GitLab [message #1817132 is a reply to message #1816910]

Fri, 15 November 2019 20:46

Thomas Wolf

Messages: 463
Registered: August 2016

Senior Member

Might be bug 552288. Can you try with JGit nightly, for instance 5.6.0-20191115.000833? Available at https://repo.eclipse.org/content/repositories/snapshots/org/eclipse/jgit/org.eclipse.jgit/5.6.0-SNAPSHOT/ .

Also to check: what does git log --show-signature show for the two commits? Are they using the same key? If not, check with gpg --list-keys which key is used. Could "signingKey" be ambiguous? If so, it might also be bug 550335.

Report message to a moderator

Re: Signing not shown as verified by GitLab [message #1817256 is a reply to message #1816910]

Tue, 19 November 2019 12:17

Thomas Wolf

Messages: 463
Registered: August 2016

Senior Member

It's bug 553206. The upshot is: GPG and Gitlab implement a future RFC4880 version, and Bouncy Castle doesn't yet. And Gitlab doesn't verify correctly if a signature follows the older RFC4880.

Nothing we can do until Bouncy Castle catches up.

Report message to a moderator

Re: Signing not shown as verified by GitLab [message #1828812 is a reply to message #1817256]

Fri, 19 June 2020 06:51

Thomas Wolf

Messages: 463
Registered: August 2016

Senior Member

Gitlab versions < 12.10 had a bug that makes signature verification fail for commits with commit messages that do not end in a newline. See https://gitlab.com/gitlab-org/gitaly/-/issues/2545 and bug 564428 comment 5.

Report message to a moderator

Previous Topic:	Merging repositories with JGit + altering commit messages
Next Topic:	EGit signing somehow not accepted by GitLab, works fine for GitHub

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Tue May 17 12:31:15 GMT 2022

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter