I'm seeing situations where invalid GPG signatures are being attached to commits. This seems to reproduce the state:

# Edit a file
sl commit -m 'My edit'
# Verify commit - passes:
git -C "$(sl root)/.sl/store/git" verify-commit "$(sl id -i)"
# Update the commit message:
sl metaedit -m 'Better description'
# Verify commit - fails:
git -C "$(sl root)/.sl/store/git" verify-commit "$(sl id -i)"

There might be other workflows that trigger this as well (rebasing possibly). I've been working around it by grafting the busted commit.

From what I can tell, the prior gigsig entry is remaining in the extra dict when generating the new commit. Inspect extra here-ish:

A hack-fix that seems to work is adding fields["extras"].pop("gpgsig", None) prior to

This is seen when building from bc5cb14.