Repository navigation
OpenPGP Ed25519 commit signing writes an incorrect issuer fingerprint and key ID #308
Description
Version
8.0.0-SNAPSHOT built from 6e68739
Operating System
MacOS, Linux/Unix
Bug description
When signing a commit with a newly generated OpenPGP Ed25519 key, JGit successfully creates the commit, but the signature's issuer fingerprint and key ID differ from those of the configured signing key. Native Git/GnuPG cannot verify the commit and reports “No public key.”
The following reproduces the issue using an isolated GnuPG home and Git repository. Run from the JGit checkout after building the CLI:
mvn -pl org.eclipse.jgit.pgm -am package -DskipTests \
-Dmaven.javadoc.skip=true -Dspotbugs.skip=true
JGIT="$PWD/org.eclipse.jgit.pgm/target/jgit"
REPRO_DIR=$(mktemp -d)
export GNUPGHOME="$REPRO_DIR/gnupg"
mkdir -m 700 "$GNUPGHOME"
gpg --batch --pinentry-mode loopback --passphrase '' \
--quick-generate-key 'Signing Reproducer <repro@example.com>' ed25519 sign 0
SIGNING_FPR=$(gpg --batch --with-colons --list-secret-keys | \
awk -F: '$1 == "fpr" { print $10; exit }')
printf 'Expected fingerprint: %s\n' "$SIGNING_FPR"
git init "$REPRO_DIR/repo"
cd "$REPRO_DIR/repo"
git config user.name 'Signing Reproducer'
git config user.email repro@example.com
git config gpg.format openpgp
git config user.signingkey "$SIGNING_FPR"
printf 'OpenPGP Ed25519 signing reproduction\n' > example.txt
git add example.txt
"$JGIT" commit -S -m 'Reproduce OpenPGP Ed25519 signing'
# Extract the signature directly from the commit's gpgsig header.
git cat-file commit HEAD | sed -n \
'/^gpgsig /,/^ -----END PGP SIGNATURE-----$/ { s/^gpgsig //; s/^ //; p; }' \
> signature.asc
gpg --list-packets signature.asc
git verify-commit HEADAssisted-By: 🤖 GPT-6.1-Sol
Actual behavior
JGit creates a signed commit successfully, but with a different key than expected. In the reproduction:
| Value | Fingerprint / key ID |
|---|---|
| Generated and configured key fingerprint | EFBC6DED33DB148BC822B7C1F7ED699DBCF8E2BD |
| Expected key ID | F7ED699DBCF8E2BD |
| Observed signature issuer fingerprint | 1D98ADE46986DF537ADA692DCC539A42D1D7C769 |
| Observed signature issuer key ID | CC539A42D1D7C769 |
git verify-commit HEAD exits with status 1 because GnuPG cannot find the public key identified by the signature.
Expected behavior
The signature should identify the configured Ed25519 signing key using its correct fingerprint and key ID. Native Git/GnuPG should successfully verify the commit using the generated public key.
Relevant log output
Generated key listing:
sec:u:255:22:F7ED699DBCF8E2BD:1791532939:::u:::scSC:::+::ed25519:::0:
fpr:::::::::EFBC6DED33DB148BC822B7C1F7ED699DBCF8E2BD:
Inspection of the signature extracted from the commit:
# off=0 ctb=c2 tag=2 hlen=2 plen=136 new-ctb
:signature packet: algo 22, keyid CC539A42D1D7C769
version 4, created 1791532944, md5len 0, sigclass 0x00
digest algo 8, begin of digest 1d 82
critical hashed subpkt 2 len 4 (sig created 2026-10-09)
hashed subpkt 33 len 21 (issuer fpr v4 1D98ADE46986DF537ADA692DCC539A42D1D7C769)
hashed subpkt 28 len 17 (signer's user ID)
subpkt 16 len 8 (issuer key ID CC539A42D1D7C769)
data: [255 bits]
data: [255 bits]
Native Git verification:
gpg: Signature made Fri Oct 9 08:02:24 2026 UTC
gpg: using EDDSA key 1D98ADE46986DF537ADA692DCC539A42D1D7C769
gpg: issuer "repro@example.com"
gpg: Can't check signature: No public keyOther information
- Java: OpenJDK 25.0.4.1 (Red Hat).
- Native Git: 2.55.0.
- GnuPG: 2.4.9; libgcrypt: 1.12.2-unknown.
- Bouncy Castle: 1.86; signature armor includes
Version: BCPG v1.86. - The generated OpenPGP key is an Ed25519 primary signing key, with no subkeys and no passphrase.
- A separate SSH Ed25519 signing control succeeded: the public key embedded in the commit's SSHSIG matched the generated public key byte for byte, and nati
ve Git verified the signature.
Activity
zakkak commentedon Oct 14, 2026
Fix:
https://eclipse.gerrithub.io/c/eclipse-jgit/jgit/+/1254393