Repository: withoutboats/bpb (language: rust)

Issue:
Can't verify signatures made with bpb
Running `git log --show-signature` results in an error message instead of a successful signature verification for commits signed via bpb.

```
$ git log --show-signature
commit 96d4ddb4496a216664879926fe3305046d10feac (HEAD -> master, origin/master, origin/HEAD)
gpg: standalone signature of class 0x10
gpg: Signature made Fri 20 Jul 2018 10:47:24 AM EDT
gpg:                using EDDSA key 72C535312E76C3E03209F693174625E5E877C0D9
gpg: invalid root packet for sigclass 10
gpg: Can't check signature: Invalid signature class
Author: Without Boats <boats@mozilla.com>
Date:   Fri Jul 20 16:47:19 2018 +0200

    Add repository link
```

Here is the output of `git log --show-signature` on [this commit](https://github.com/kryptco/krypton-ios/pull/95/commits/8f4df45b88e38b52772922db3c5e96f3dc3713c1), also signed with a ed25519 key (key can be found [here](https://api.github.com/users/agrinman/gpg_keys). (Commit has no relation to this issue, I just grabbed it at random via google since I haven't yet used a ed25519 git signing key myself). 

```
$ git log --show-signature
commit 8f4df45b88e38b52772922db3c5e96f3dc3713c1 (HEAD -> feature-pgp-signatures, origin/feature-pgp-signatures)
gpg: Signature made Mon 27 Nov 2017 04:51:37 PM EST
gpg:                using EDDSA key 98A36F73E64CAEA0
gpg: Can't check signature: No public key
Author: Alex Grinman <alex@krypt.co>
Date:   Mon Nov 27 16:51:35 2017 -0500

    pgp blob signing
```

```
$ gpg --version
gpg (GnuPG) 2.2.9
libgcrypt 1.8.3
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/normal/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
```


Discussion / hints:
Yea I got this error too; it appears that I'm creating the wrong signature class.

It would help expedite things for me to have a known good signature (generated by gpg) to compare, and the fastest way for me to get that would be for you to post the one you have. That is, I'd like to see the ASCII armored signature file so I can pgpdump it.

You can get this by seeing the actual git object with `git cat-file -p 8f4df45b88e38b52772922db3c5e96f3dc3713c1`
Made and signed a fresh commit with gpg, since the previous commit I tracked down was signed by krypton and gpg seems more authoritative

```
tree 849e7cb122db2d2ad438dd09bc8e609cf787eb01
parent 96d4ddb4496a216664879926fe3305046d10feac
author morenzg <morenzg@gmail.com> 1532609681 -0400
committer morenzg <morenzg@gmail.com> 1532609681 -0400
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQScEo4BX8QQnHJgn40x5nNTBggn8QUCW1nEkQAKCRAx5nNTBggn
 8VYlAP0fYZiVcN8ILFzK6FVr1qc5EktVcoJua+Oc0uZ0HP52DQEAht0+QZaw3eqL
 +aYznDrGae24/1ZzuXLJ4/TGulS+Ggo=
 =afM1
 -----END PGP SIGNATURE-----

test
```

And here's the output of --list-packets on that signature

```
$ gpg --list-packets tmp
# off=0 ctb=88 tag=2 hlen=2 plen=117
:signature packet: algo 22, keyid 31E67353060827F1
	version 4, created 1532609681, md5len 0, sigclass 0x00
	digest algo 8, begin of digest 56 25
	hashed subpkt 33 len 21 (issuer fpr v4 9C128E015FC4109C72609F8D31E67353060827F1)
	hashed subpkt 2 len 4 (sig created 2018-07-26)
	subpkt 16 len 8 (issuer key ID 31E67353060827F1)
	data: [253 bits]
	data: [256 bits]
```
Thanks so much, that's really useful! The problem is that I'm creating sigclass 0x10 (GenericCertification) when I should be creating sigclass 0x00 (BinaryDocument). If you'd be interested in submitting a PR, the line that needs to change is here: https://github.com/withoutboats/bpb/blob/master/src/key_data.rs#L32, it needs to be the BinaryDocument variant (the enum's docs are here: https://docs.rs/pbp/0.3.1/pbp/enum.SigType.html).
Awesome, I'll submit one this evening :)

On Thu, Jul 26, 2018, 09:20 boats, <notifications@github.com> wrote:

> Thanks so much, that's really useful! The problem is that I'm creating
> sigclass 0x10 (GenericCertification) when I should be creating sigclass
> 0x00 (BinaryDocument). If you'd be interested in submitting a PR, the line
> that needs to change is here:
> https://github.com/withoutboats/bpb/blob/master/src/key_data.rs#L32, it
> needs to be the BinaryDocument variant (the enum's docs are here:
> https://docs.rs/pbp/0.3.1/pbp/enum.SigType.html).
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/withoutboats/bpb/issues/2#issuecomment-408095037>, or mute
> the thread
> <https://github.com/notifications/unsubscribe-auth/AAkYBALY9ovAdi-ZCE2UF70ulrfacz52ks5uKcIvgaJpZM4Vg-8O>
> .
>

Thanks :D

Fix patch:
diff --git a/src/key_data.rs b/src/key_data.rs
index c5729e6..6803aa5 100644
--- a/src/key_data.rs
+++ b/src/key_data.rs
@@ -29,7 +29,7 @@ impl KeyData {
             &self.keypair,
             data,
             self.fingerprint(),
-            pbp::SigType::GenericCertification,
+            pbp::SigType::BinaryDocument,
             timestamp as u32,
         ))
     }


Test patch: