54
54
``re-sign`` is also useful to change an existing signature.
56
By default Bazaar will tell GnuPG to use a key with the same user
57
identity as the one set with ``whoami``. To override this set
58
``gpg_signing_key`` in bazaar.conf or locations.conf.
60
``gpg_signing_key=DD4D5088``
62
``gpg_signing_key=amy@example.com``
67
Signatures can be verified with the ``bzr verify-signatures`` command. By
68
default this will check all commits in the branch and notify that all commits
69
are signed by known trusted signatures. If not all commits have trusted
70
signatures it will give a summary of the number of commits which are invalid,
71
having missing keys or are not signed.
73
The ``verify-signatures`` command can be given a comma separated list of key
74
patters to specify a list of acceptable keys. It can also take a range of
75
commits to verify in the current branch. Finally using the verbose option will
76
list each key that is valid or authors for commits which failed::
78
$bzr verify-signatures -kamy -v -r 1..5
79
1 commit with valid signature
80
Amy Pond <amy@example.com> signed 4 commits
81
0 commits with unknown keys
83
1 commit by author The Doctor <doctor@example.com>
59
Unfortunately there is currently no command for verifying signatures. This can
60
be done manually using bzrlib and Python::
62
>>> from bzrlib.branch import Branch
63
>>> b = Branch.open('/home/amy/src/daleks')
65
'amy@example.com-20110527185938-hluafawphszb8dl1'
66
>>> print b.repository.get_signature_text(b.last_revision())
67
-----BEGIN PGP SIGNED MESSAGE-----
70
bazaar-ng testament short form 1
71
revision-id: amy@example.com-20110527185938-hluafawphszb8dl1
72
sha1: 6411f9bdf6571200357140c9ce7c0f50106ac9a4
73
-----BEGIN PGP SIGNATURE-----
74
Version: GnuPG v1.4.11 (GNU/Linux)
76
iEYEARECAAYFAk32HFcACgkQpQbm1N1NUIiBXACg6ILsyvJp4+Twq190qk1I4v9K
77
PAAAoI8pg9s7uuqldqOwz6/uwH3ezdSX
79
-----END PGP SIGNATURE-----
81
The signature can be saved to a file and verified with ``gpg --verify
84
The signed SHA1 checksum is made from the ``bzr testament --long`` command
85
which includes information on the committer and a list of all files in that
86
commit along with their checksums. So if the signature is valid you can be
87
sure you are looking at the same code as the person who made the signature.
89
There is still a number of digital signature related features which
90
are hoped to be added to Bazaar soon. These include bzr explorer
91
integration and setting branches to require signatures.
92
There is still a number of digital signature related features which are hoped
93
to be added to Bazaar soon. These include easy verificiation, qbzr
94
integration, signing with different keys and setting branches to require
added
removed
doc/en/user-guide/gpg_signatures.txt
