Many more sigs show when I add --with-colons to --list-sigs

[Robert J. Hansen]

> Except for proof that the signatures were in fact made with SHA-1. Look,
> I'm just trying to understand what's going on. It's not exactly 
> straightforward.

This is sort of like a LibreOffice user asking detailed questions about
why their word processor document is structured the way it is. There are
answers, but the answers are highly technical and not really relevant to
how you use GnuPG. It's reasonable to ask, "do you really need to go
down this rabbit hole?"

If you do, then I'm happy to explain GnuPG data structures and
internals. But if you don't, I'd like to devote my limited free time to
other pursuits. :)

> Why do --list-sigs and --check-sigs show different signatures?

I'm afraid this answer will seem condescending: I don't mean it to be.
This answer is accurate.

Different commands show different outputs because they do different things.

To list a signature, the only thing GnuPG needs is the signature. If you
give me a document with 100 signatures and I ask it to list the
signatures, I'll get a hundred signatures back.

To check a signature, GnuPG needs the document, the signature, and the
public part of the certificate used for signing. If you give me a
document with 100 signatures and I only have the public cert for one,
GnuPG will report *one* signature check and say "99 signatures went
unchecked for lack of a public cert."

Different commands show different outputs because they do different things.

> Seriously, I don't mean to be a jerk either, but this also means that
> gpg has had 26 years to make the output be more consistent and easier
> to understand.

Yep. If you're saying GnuPG could use some work, everyone here is in
agreement. Take a look at our bug tracker sometime.

If you know C and cryptographic engineering, things will get better
faster if you help.

(Also, for the record, I'm not part of the GnuPG development team. I'm
just a user. I'm speaking only as a member of the community, not as part
of the team.)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20260729/2532a856/attachment.sig>