undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

merge: add config option for verifySignatures

Browse Source 
git merge --verify-signatures can be used to verify that the tip commit
of the branch being merged in is properly signed, but it's cumbersome to
have to specify that every time.

Add a configuration option that enables this behaviour by default, which
can be overridden by --no-verify-signatures.

Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Hans Jerry Illikainen 2017-12-10 06:53:57 +00:00 committed by Junio C Hamano
parent 95ec6b1b33
commit ca779e82c9
3 changed files with 45 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/merge-config.txt
View File

@ -26,6 +26,10 @@ merge.ff::
allowed (equivalent to giving the `--ff-only` option from the allowed (equivalent to giving the `--ff-only` option from the
command line). command line).
merge.verifySignatures::
If true, this is equivalent to the --verify-signatures command
line option. See linkgit:git-merge[1] for details.
include::fmt-merge-msg-config.txt[] include::fmt-merge-msg-config.txt[]
merge.renameLimit:: merge.renameLimit::

2
builtin/merge.c
View File

@ -567,6 +567,8 @@ static int git_merge_config(const char *k, const char *v, void *cb)
if (!strcmp(k, "merge.diffstat") || !strcmp(k, "merge.stat")) if (!strcmp(k, "merge.diffstat") || !strcmp(k, "merge.stat"))
show_diffstat = git_config_bool(k, v); show_diffstat = git_config_bool(k, v);
else if (!strcmp(k, "merge.verifysignatures"))
verify_signatures = git_config_bool(k, v);
else if (!strcmp(k, "pull.twohead")) else if (!strcmp(k, "pull.twohead"))
return git_config_string(&pull_twohead, k, v); return git_config_string(&pull_twohead, k, v);
else if (!strcmp(k, "pull.octopus")) else if (!strcmp(k, "pull.octopus"))

39
t/t7612-merge-verify-signatures.sh
View File

@ -39,23 +39,62 @@ test_expect_success GPG 'merge unsigned commit with verification' '
test_i18ngrep "does not have a GPG signature" mergeerror test_i18ngrep "does not have a GPG signature" mergeerror
' '
test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '
test_config merge.verifySignatures true &&
test_must_fail git merge --ff-only side-unsigned 2>mergeerror &&
test_i18ngrep "does not have a GPG signature" mergeerror
'
test_expect_success GPG 'merge commit with bad signature with verification' ' test_expect_success GPG 'merge commit with bad signature with verification' '
test_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror && test_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&
test_i18ngrep "has a bad GPG signature" mergeerror test_i18ngrep "has a bad GPG signature" mergeerror
' '
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '
test_config merge.verifySignatures true &&
test_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&
test_i18ngrep "has a bad GPG signature" mergeerror
'
test_expect_success GPG 'merge commit with untrusted signature with verification' ' test_expect_success GPG 'merge commit with untrusted signature with verification' '
test_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror && test_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&
test_i18ngrep "has an untrusted GPG signature" mergeerror test_i18ngrep "has an untrusted GPG signature" mergeerror
' '
test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '
test_config merge.verifySignatures true &&
test_must_fail git merge --ff-only side-untrusted 2>mergeerror &&
test_i18ngrep "has an untrusted GPG signature" mergeerror
'
test_expect_success GPG 'merge signed commit with verification' ' test_expect_success GPG 'merge signed commit with verification' '
test_when_finished "git checkout initial" &&
git merge --verbose --ff-only --verify-signatures side-signed >mergeoutput && git merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&
test_i18ngrep "has a good GPG signature" mergeoutput test_i18ngrep "has a good GPG signature" mergeoutput
' '
test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '
test_when_finished "git checkout initial" &&
test_config merge.verifySignatures true &&
git merge --verbose --ff-only side-signed >mergeoutput &&
test_i18ngrep "has a good GPG signature" mergeoutput
'
test_expect_success GPG 'merge commit with bad signature without verification' ' test_expect_success GPG 'merge commit with bad signature without verification' '
test_when_finished "git checkout initial" &&
git merge $(cat forged.commit) git merge $(cat forged.commit)
' '
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '
test_when_finished "git checkout initial" &&
test_config merge.verifySignatures false &&
git merge $(cat forged.commit)
'
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '
test_when_finished "git checkout initial" &&
test_config merge.verifySignatures true &&
git merge --no-verify-signatures $(cat forged.commit)
'
test_done test_done