Skip to content

Commit 0433d53

Browse files
gitstergitster
committed
Merge branch 'hi/merge-verify-sig-config'
"git merge" learned to pay attention to merge.verifySignatures configuration variable and pretend as if '--verify-signatures' option was given from the command line. * hi/merge-verify-sig-config: t5573, t7612: clean up after unexpected success of 'pull' and 'merge' t: add tests for pull --verify-signatures merge: add config option for verifySignatures
2 parents fc4a226 + fb2afea commit 0433d53

File tree

4 files changed

+132
-0
lines changed

4 files changed

+132
-0
lines changed

‎Documentation/merge-config.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ merge.ff::
2626
allowed (equivalent to giving the `--ff-only` option from the
2727
command line).
2828

29+
merge.verifySignatures::
30+
If true, this is equivalent to the --verify-signatures command
31+
line option. See linkgit:git-merge[1] for details.
32+
2933
include::fmt-merge-msg-config.txt[]
3034

3135
merge.renameLimit::

‎builtin/merge.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,8 @@ static int git_merge_config(const char *k, const char *v, void *cb)
567567

568568
if (!strcmp(k, "merge.diffstat") || !strcmp(k, "merge.stat"))
569569
show_diffstat = git_config_bool(k, v);
570+
else if (!strcmp(k, "merge.verifysignatures"))
571+
verify_signatures = git_config_bool(k, v);
570572
else if (!strcmp(k, "pull.twohead"))
571573
return git_config_string(&pull_twohead, k, v);
572574
else if (!strcmp(k, "pull.octopus"))

‎t/t5573-pull-verify-signatures.sh‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#!/bin/sh
2+
3+
test_description='pull signature verification tests'
4+
. ./test-lib.sh
5+
. "$TEST_DIRECTORY/lib-gpg.sh"
6+
7+
test_expect_success GPG 'create repositories with signed commits' '
8+
echo 1 >a && git add a &&
9+
test_tick && git commit -m initial &&
10+
git tag initial &&
11+
12+
git clone . signed &&
13+
(
14+
cd signed &&
15+
echo 2 >b && git add b &&
16+
test_tick && git commit -S -m "signed"
17+
) &&
18+
19+
git clone . unsigned &&
20+
(
21+
cd unsigned &&
22+
echo 3 >c && git add c &&
23+
test_tick && git commit -m "unsigned"
24+
) &&
25+
26+
git clone . bad &&
27+
(
28+
cd bad &&
29+
echo 4 >d && git add d &&
30+
test_tick && git commit -S -m "bad" &&
31+
git cat-file commit HEAD >raw &&
32+
sed -e "s/bad/forged bad/" raw >forged &&
33+
git hash-object -w -t commit forged >forged.commit &&
34+
git checkout $(cat forged.commit)
35+
) &&
36+
37+
git clone . untrusted &&
38+
(
39+
cd untrusted &&
40+
echo 5 >e && git add e &&
41+
test_tick && git commit -SB7227189 -m "untrusted"
42+
)
43+
'
44+
45+
test_expect_success GPG 'pull unsigned commit with --verify-signatures' '
46+
test_when_finished "git reset --hard && git checkout initial" &&
47+
test_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&
48+
test_i18ngrep "does not have a GPG signature" pullerror
49+
'
50+
51+
test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '
52+
test_when_finished "git reset --hard && git checkout initial" &&
53+
test_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&
54+
test_i18ngrep "has a bad GPG signature" pullerror
55+
'
56+
57+
test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '
58+
test_when_finished "git reset --hard && git checkout initial" &&
59+
test_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&
60+
test_i18ngrep "has an untrusted GPG signature" pullerror
61+
'
62+
63+
test_expect_success GPG 'pull signed commit with --verify-signatures' '
64+
test_when_finished "git reset --hard && git checkout initial" &&
65+
git pull --verify-signatures signed >pulloutput &&
66+
test_i18ngrep "has a good GPG signature" pulloutput
67+
'
68+
69+
test_expect_success GPG 'pull commit with bad signature without verification' '
70+
test_when_finished "git reset --hard && git checkout initial" &&
71+
git pull --ff-only bad 2>pullerror
72+
'
73+
74+
test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '
75+
test_when_finished "git reset --hard && git checkout initial" &&
76+
test_config merge.verifySignatures true &&
77+
test_config pull.verifySignatures true &&
78+
git pull --ff-only --no-verify-signatures bad 2>pullerror
79+
'
80+
81+
test_done

‎t/t7612-merge-verify-signatures.sh‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,27 +35,72 @@ test_expect_success GPG 'create signed commits' '
3535
'
3636

3737
test_expect_success GPG 'merge unsigned commit with verification' '
38+
test_when_finished "git reset --hard && git checkout initial" &&
3839
test_must_fail git merge --ff-only --verify-signatures side-unsigned 2>mergeerror &&
3940
test_i18ngrep "does not have a GPG signature" mergeerror
4041
'
4142

43+
test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '
44+
test_when_finished "git reset --hard && git checkout initial" &&
45+
test_config merge.verifySignatures true &&
46+
test_must_fail git merge --ff-only side-unsigned 2>mergeerror &&
47+
test_i18ngrep "does not have a GPG signature" mergeerror
48+
'
49+
4250
test_expect_success GPG 'merge commit with bad signature with verification' '
51+
test_when_finished "git reset --hard && git checkout initial" &&
4352
test_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&
4453
test_i18ngrep "has a bad GPG signature" mergeerror
4554
'
4655

56+
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '
57+
test_when_finished "git reset --hard && git checkout initial" &&
58+
test_config merge.verifySignatures true &&
59+
test_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&
60+
test_i18ngrep "has a bad GPG signature" mergeerror
61+
'
62+
4763
test_expect_success GPG 'merge commit with untrusted signature with verification' '
64+
test_when_finished "git reset --hard && git checkout initial" &&
4865
test_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&
4966
test_i18ngrep "has an untrusted GPG signature" mergeerror
5067
'
5168

69+
test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '
70+
test_when_finished "git reset --hard && git checkout initial" &&
71+
test_config merge.verifySignatures true &&
72+
test_must_fail git merge --ff-only side-untrusted 2>mergeerror &&
73+
test_i18ngrep "has an untrusted GPG signature" mergeerror
74+
'
75+
5276
test_expect_success GPG 'merge signed commit with verification' '
77+
test_when_finished "git reset --hard && git checkout initial" &&
5378
git merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&
5479
test_i18ngrep "has a good GPG signature" mergeoutput
5580
'
5681

82+
test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '
83+
test_when_finished "git reset --hard && git checkout initial" &&
84+
test_config merge.verifySignatures true &&
85+
git merge --verbose --ff-only side-signed >mergeoutput &&
86+
test_i18ngrep "has a good GPG signature" mergeoutput
87+
'
88+
5789
test_expect_success GPG 'merge commit with bad signature without verification' '
90+
test_when_finished "git reset --hard && git checkout initial" &&
91+
git merge $(cat forged.commit)
92+
'
93+
94+
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '
95+
test_when_finished "git reset --hard && git checkout initial" &&
96+
test_config merge.verifySignatures false &&
5897
git merge $(cat forged.commit)
5998
'
6099

100+
test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '
101+
test_when_finished "git reset --hard && git checkout initial" &&
102+
test_config merge.verifySignatures true &&
103+
git merge --no-verify-signatures $(cat forged.commit)
104+
'
105+
61106
test_done

0 commit comments

Comments
 (0)