keybase / keybase/keybase-issues
`keybase sign` and https://keybase.io/sign differ
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
When I use https://keybase.io/sign, the result is something like this:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
This is something. It should be signed.
-----BEGIN PGP SIGNATURE-----
Version: Keybase OpenPGP JS 0.0.1
Comment: https://keybase.io/crypto
wsFcBAABCgAGBQJTJuORAAoJENxXPbmyJufq6RMQAJZMBrNlLxKL65hP/wktCVc3
fTaFgtE9SY+h9NNNoWDWgtOPHdiXixX0jJ8BONphuLXtYk53cmVuMgYqZaU9Cgfy
06m2X2S6Sn4RZ1K8ggqprHGWdexFbY2VB9g4w8q3k00BtSNMfTBjWjuP/OkMDH8R
MqPXxrloM3d4IJUExqWpM8T1i6T4B1GGGnuJV+5x77CgX6imruCdIOWhJsK4d3S2
D4qvifqibMP6bkznVdI9ny6yKmD4XQAGlvXXFYd83UByvmieNxTXo9r0vAd828jZ
BdFHiWgUjwqpalB2slDtQwIyY13AwDZ5mju9hSDCZNEdetfAudmuzZ6XU8vrh5Y1
2bMrpXD1kPtl06IusRytpON4NSJvDsLGbma6Hj5q8DpDjr85KmiPeQh3jL7XNyNU
lpE8XGLSxli3wolaVA32jWR2zRKe5NNRmyDfJIQRgXITLuhqNdMWa9PYmutGIZUn
Dfuv2ti67FRY61moqy3dvZmHiLVg/IVzhyBUnBwzLKlk6Fh0+cIAraHG4wpYST0l
I2YL04/3woiEZnI6QnOHJgkdXeqv8tyyHjmwLV6/ZqqunRtCjwhVAIwmFsNn32re
uJ1VmyrKfISWpd2uqVWFzCcqXpEzF6tIsmEuy643JFoGitNrA5eQGeeexi2D2IdW
zqhaoilbLEQNtviZ3Yx8
=MKmL
-----END PGP SIGNATURE-----
```
When I use `keybase sign -m "This is something. It should be signed."`, the result is something like this:
```
-----BEGIN PGP MESSAGE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org
owEBXQKi/ZANAwAKAdxXPbmyJufqAcstYgBTJuPYVGhpcyBpcyBzb21ldGhpbmcu
IEl0IHNob3VsZCBiZSBzaWduZWQuiQIcBAABCgAGBQJTJuPYAAoJENxXPbmyJufq
1yMP/jPHjv9w3XcOV+CUT8sHyxC9YE7lkOHXcMj65ptAZZ08JYtZQ1aSZCkkx3AF
2hSVZSRTjEI6wVSbbA4AQw2MFsNwKTpjJJ6Hsvm7GhqxvJ0qkB7BmXQpxmnrF7ap
bPnQkWtlN5HFEDQ3fKRP9DapPuSQnfzEiD3r37NTaQDkcpdoDzHYH+zjKoFqX1gY
yaLHW6CHXo9VBqK3xP+AEupsUYLHWqgihC2sibUaeDBuL4UZG84kqd+W3rqzyekr
AjKcBxG9z82VxsJTGKKPZIaI7OATbeuFVZimjepZO1YkTiOWLw7ICfifEmWJ0P7t
MtCmuMJuX0SSaBMXhfRh+5hCFD9pGFqAkmIU2xfBPy+YUvuvNLIvdtkwtgU4jadg
OaKaTKh0AxFH+r2w3sgmT2mQoknJRSQkKeGxedlhq8OYJq8misODOALqL/n5FaRa
goBRaC7wqlCPiOWSlfRSID0EI94bltO9kwvwzu/wz1xT48bjmuPDbXx+cmYfTzKe
kszc/z9A4lQeEWvzuzueSeko33YrSQHVVpxQ6tPzKIf2SHjlWW1ddrXT1cLG5jsU
Uk/TohxgbQiqBNZFer2dNBXnAVUTrpL8hISrWzAXvgFzhE7zwe+8ptixqNL11y29
6Pl1NgGAzouev6/Kh/jQW+erjZyxQjv3p4yHZkpy1rfUfnrp
=zzal
-----END PGP MESSAGE-----
```
The former can be copy/pasted into an email client, and recipients can view the contents immediately, and optionally verify.
The second seems to require that the recipient use a verify function before seeing the contents.
Why the difference? Are these commands supposed to be analogous? Can one be updated to match the other?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by comparing the output of `keybase sign -m` with the output from https://keybase.io/sign, focusing on the OpenPGP message types shown in the examples. Determine whether the CLI should produce a cleartext signed message that email clients can display, and verify the result with the relevant signing and verification commands.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, cryptography
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100