Occasional invalid RSA signature under repeated signing (gpg 2.3.7 / libgcrypt 1.10.1)

[Diggory Blake]

Hi,

That does seem to be the issue: my `p` and `q` are stored in the wrong order.

Do you know what the implications are for historical commits I've
signed? Also, it seems like the issue is not limited to macos, since
this occurred on windows.

Thanks,
Diggory

On Fri, Jul 10, 2026 at 8:20 AM NIIBE Yutaka <gniibe at fsij.org> wrote:
>
> Hello,
>
> Thank you for your report.
>
> Diggory Blake wrote:
> > ## What happened
> >
> > I signed a git commit with `git commit --amend --no-edit` (which calls
> > `gpg -bsau <KEY>` under the hood), and later noticed `git verify-commit`
> > reports it as `BAD signature`. The key is the right one, and every
> > other commit I've signed around that time verifies fine — only this one
> > is broken.
>
> How your key was generated, I wonder.  This year, we encountered
> an issue (of P and Q):
>
>     https://lists.gnupg.org/pipermail/gnupg-users/2026-March/068163.html
>
> Please check your P and Q.
> --