hi,

When using setup.py upload --sign without --identity, gpg can give weird messages.

Rather than this error message:
"""running upload
gpg --detach-sign --local-user gn -a dist/pywebsite-0.1.18pre.tar.gz
gpg: skipped "gn": secret key not available
gpg: signing failed: secret key not available
error: command 'gpg' failed with exit status 2
make: *** [upload] Error 1"""

It might be nicer to also mention using --identity=, as well as a link to the documentation for --sign (url and also the help from "--help upload").

cheers,

are you suggesting that a warning stating that 

'--identity has`nt been used'

has to be generated?

We had a look at this bug during a sprint last week.  First, it is reasonable to use --sign without --identity, as gpg will fall back to a default identity (see the description of --local-user and --default-key in the gpg man page).  Second, it looks like you run distutils commands from a script or makefile and you have a bug there (the “skipped "gn"” message looks suspicious, maybe -sign was used instead of --sign and interpreted as -s -i gn).  Finally, even though we thing this is not a bug, we agreed that it would be nicer to print a message to make clear that distutils2 is not broken but shows the error message from gpg on purpose; this may be done during the next sprint.