)]}'
{
  "commit": "67a6ea63008bcee32a239934ad29eb5c5a554509",
  "tree": "ced58695d6c423f4ae0db505d095dbd3463fe592",
  "parents": [
    "392b862e9aea69acf43532527e27644c97e3ea56"
  ],
  "author": {
    "name": "Hans Jerry Illikainen",
    "email": "hji@dyntopia.com",
    "time": "Fri Nov 22 20:23:12 2019 +0000"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Sat Nov 23 09:18:40 2019 +0900"
  },
  "message": "gpg-interface: limit search for primary key fingerprint\n\nThe VALIDSIG status line from GnuPG with --status-fd is documented to\nhave 9 required and 1 optional fields [1].  The final, and optional,\nfield is used to specify the fingerprint of the primary key that made\nthe signature in case it was made by a subkey.  However, this field is\nonly available for OpenPGP signatures; not for CMS/X.509.\n\nIf the VALIDSIG status line does not have the optional 10th field, the\ncurrent code will continue reading onto the next status line.  And this\nis the case for non-OpenPGP signatures [1].\n\nThe consequence is that a subsequent status line may be considered as\nthe \"primary key\" for signatures that does not have an actual primary\nkey.\n\nLimit the search of these 9 or 10 fields to the single line to avoid\nthis problem.  If the 10th field is missing, report that there is no\nprimary key fingerprint.\n\n[Reference]\n\n[1] GnuPG Details, General status codes\nhttps://git.gnupg.org/cgi-bin/gitweb.cgi?p\u003dgnupg.git;a\u003dblob;f\u003ddoc/DETAILS;h\u003d6ce340e8c04794add995e84308bb3091450bd28f;hb\u003dHEAD#l483\n\nThe documentation says:\n\n    VALIDSIG \u003cargs\u003e\n\n    The args are:\n\n    - \u003cfingerprint_in_hex\u003e\n    - \u003csig_creation_date\u003e\n    - \u003csig-timestamp\u003e\n    - \u003cexpire-timestamp\u003e\n    - \u003csig-version\u003e\n    - \u003creserved\u003e\n    - \u003cpubkey-algo\u003e\n    - \u003chash-algo\u003e\n    - \u003csig-class\u003e\n    - [ \u003cprimary-key-fpr\u003e ]\n\n    This status indicates that the signature is cryptographically\n    valid. [...] PRIMARY-KEY-FPR is the fingerprint of the primary key\n    or identical to the first argument.\n\n    The primary-key-fpr parameter is used for OpenPGP and not available\n    for CMS signatures.  [...]\n\nSigned-off-by: Hans Jerry Illikainen \u003chji@dyntopia.com\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "37162c9a43c7e3b5d9135da55520021798a0d160",
      "old_mode": 33188,
      "old_path": "gpg-interface.c",
      "new_id": "131e7d529e9bdb480c88a01a33a3dd8339d219cd",
      "new_mode": 33188,
      "new_path": "gpg-interface.c"
    },
    {
      "type": "modify",
      "old_id": "819c24d10eaa3cb4a58b72ae8a8e96151b5cabe9",
      "old_mode": 33261,
      "old_path": "t/t4202-log.sh",
      "new_id": "da8cb06f9be8368925d462f183d12184463d1d86",
      "new_mode": 33261,
      "new_path": "t/t4202-log.sh"
    }
  ]
}