Repository: pypa/twine

Issue:
Signing fails in version 1.6.0
Signing has stopped to function in the latest version, with the following message:

```
You need a passphrase to unlock the secret key for
user: "foo bar <foo@bar.com>"
1024-bit DSA key, ID ABCDEFGH, created 2015-01-01

gpg: can't open `--local-user': No such file or directory
gpg: signing failed: file open error
```

1.5.0 is ok.

Discussion:

Patch:
diff --git a/twine/package.py b/twine/package.py
index 230e5ac..e80116a 100644
--- a/twine/package.py
+++ b/twine/package.py
@@ -143,9 +143,10 @@ class PackageFile(object):
 
     def sign(self, sign_with, identity):
         print("Signing {0}".format(self.basefilename))
-        gpg_args = (sign_with, "--detach-sign", "-a", self.filename)
+        gpg_args = (sign_with, "--detach-sign")
         if identity:
             gpg_args += ("--local-user", identity)
+        gpg_args += ("-a", self.filename)
         subprocess.check_call(gpg_args)
 
         with open(self.signed_filename, "rb") as gpg:


Test patch:
diff --git a/tests/test_package.py b/tests/test_package.py
index 7b15ba9..fcc827a 100644
--- a/tests/test_package.py
+++ b/tests/test_package.py
@@ -53,5 +53,5 @@ def test_sign_file_with_identity(monkeypatch):
         pkg.sign('gpg', 'identity')
     except IOError:
         pass
-    args = ('gpg', '--detach-sign', '-a', filename, '--local-user', 'identity')
+    args = ('gpg', '--detach-sign', '--local-user', 'identity', '-a', filename)
     assert replaced_check_call.calls == [pretend.call(args)]