git_writing_an_arbitrary_blob

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		 Previous revision
git_writing_an_arbitrary_blob [2019/02/26 13:18] – created rpjdaygit_writing_an_arbitrary_blob [2025/06/13 11:56] (current) – rpjday
Line 1: Line 1:
 ===== Overview ===== ===== Overview =====
  
-How to write an arbitrary blob to a repository to add "supplemental" information.+How to write an arbitrary blob to a repository to add "supplemental" information, such as contact information or your public GPG key, but without making that blob part of the standard history. 
 + 
 +NOTE: Junio Hamano eventually decided this was a bad idea, as you can see here: [[https://tylercipriani.com/blog/2023/07/31/git-files-hidden-in-plain-sight/]]
  
 ===== The recipe ===== ===== The recipe =====
Line 14: Line 16:
  
 <code> <code>
-$ git show -p 8a1385ff5d6ab8c195f99931042b7afaf418e6b0+$ git show 8a1385ff5d6ab8c195f99931042b7afaf418e6b0
 Robert P. J. Day Robert P. J. Day
 $ $
Line 31: Line 33:
 Robert P. J. Day Robert P. J. Day
 $ $
 +</code>
 +
 +In fact, this technique is used by Git maintainer Junio Hamano to disseminate his public GPG key with the Git source code:
 +
 +<code>
 +$ git show junio-gpg-pub
 +tag junio-gpg-pub
 +Tagger: Junio C Hamano <gitster@pobox.com>
 +Date:   Thu Nov 20 15:12:15 2014 -0800
 +
 +GPG key to sign git.git archive
 +
 +This blob contains the GPG public key I use to sign git.git archive.
 +
 +To use it to verify tags I signed, do:
 +
 +  $ git-cat-file blob junio-gpg-pub | gpg --import
 +
 +to import it into your keyring, and then
 +
 +  $ git-tag -v $tag_to_be_verified
 +
 +The fingerprint information for the key is as follows:
 +
 +$ gpg --fingerprint -k 96AFE6CB\!
 +pub   4096R/713660A7 2011-10-01
 +      Key fingerprint = 96E0 7AF2 5771 9559 80DA  D100 20D0 4E5A
 +      7136 60A7
 +uid                  Junio C Hamano <gitster@pobox.com>
 +uid                  Junio C Hamano <junio@pobox.com>
 +uid                  Junio C Hamano <jch@google.com>
 +sub   4096R/833262C4 2011-10-01
 +sub   4096R/96AFE6CB 2011-10-03 [expires: 2015-09-21]
 +sub   4096R/B3F7CAC9 2014-09-20 [expires: 2017-09-19]
 +-----BEGIN PGP SIGNATURE-----
 +Version: GnuPG v1
 +
 +iQIcBAABAgAGBQJUbnV7AAoJELC16IaWr+bLvjYP+wSOG8rp1y77ExHDJQj7HBLm
 +9PVQIb70tkiBxAGUpVNNbaoJQBuMAgFdT4Baj8CIo2jdzDeeqbjtcdy/XsHZ3IMl
 +
 +... etc etc ...
 </code> </code>
  • git_writing_an_arbitrary_blob.1551187115.txt.gz
  • Last modified: 2019/02/26 13:18
  • by rpjday