From f5fc8df542dfee71821109741d5d324ac58dc0f9 Mon Sep 17 00:00:00 2001 From: Robert Nio <50460704+githubrobbi@users.noreply.github.com> Date: Mon, 20 Jul 2026 15:51:50 -0700 Subject: [PATCH] fix(signing): doctor-signing now catches identity/GitHub-account mismatches A signing key can pass every existing doctor-signing check - gpgsign on, key configured, key can actually sign, key registered on GitHub - and commits STILL render "Unverified" (reason: no_user) if git's user.email isn't a verified address on the same GitHub account that owns the key. GitHub can attribute the cryptographic signature but not the commit identity, and none of the prior checks catch this: it's a silent gap between "signing works" and "commits verify." Found live: today's session signed several commits correctly under a git identity (clauderobert@nios.net) that wasn't a verified email on the account (githubrobbi) the configured key is registered to. doctor-signing reported fully green the whole time; only gh api .../commits caught it after the fact. Adds the missing check: user.email against `gh api user/emails`. Same graceful-degrade posture as the existing GPG-key-registration check (advisory info note, not a hard fail, when the token lacks the user:email scope) so this stays a soft, informative check consistent with the rest of the doctor. Co-Authored-By: Claude Fable 5 --- just/workflow.just | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/just/workflow.just b/just/workflow.just index 0e91d01..b7f6c2d 100644 --- a/just/workflow.just +++ b/just/workflow.just @@ -291,6 +291,27 @@ doctor-signing: fi fi + # Identity check: a key that signs fine and IS registered on GitHub + # still renders "Unverified" (reason: no_user) if the commit's + # user.email isn't a verified email on the SAME GitHub account the key + # is registered to - GitHub can't attribute the commit to anyone. This + # is a silent failure mode: every check above passes, the signature is + # cryptographically valid, and the commit still shows Unverified. + email=$(git config --get user.email || true) + if [[ -n "$email" ]]; then + if gh_emails=$(gh api user/emails --jq '.[].email' 2>/dev/null); then + if printf '%s\n' "$gh_emails" | grep -qxF "$email"; then + ok "user.email ($email) matches a verified GitHub email" + else + bad "user.email ($email) is not a verified email on your GitHub account - the signature will be valid but the commit shows 'Unverified' (GitHub can't attribute it to anyone). Fix: git config user.email (see https://github.com/settings/emails), matching whichever account this signing key is registered to" + fi + else + info "could not list your GitHub account emails (gh token lacks user:email scope) - skipped; verify manually that '$email' is registered at https://github.com/settings/emails" + fi + else + bad "no user.email configured - git config user.email @users.noreply.github.com" + fi + if (( fail )); then printf "\033[0;31m❌ signing setup incomplete - commits may be rejected by main's ruleset.\033[0m\n" >&2 exit 1