{"thread":{"id":"35279","subject":"[PATCH] Add the commit.gpgsign option to sign all commits","startedAt":"2013-11-04T23:14:41Z","lastAt":"2013-11-06T19:27:02Z","messageCount":7,"participants":["Nicolas Vigier","Junio C Hamano","brian m. carlson"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"230100","messageId":"1383606881-2979-1-git-send-email-boklm@mars-attacks.org","threadId":"35279","inReplyTo":null,"subject":"[PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Nicolas Vigier","fromEmail":"boklm@mars-attacks.org","sentAt":"2013-11-04T23:14:41Z","receivedAt":"2013-11-04T23:14:41Z","isPatch":true,"sender":{"key":"boklm@mars-attacks.org","avatar":"https://avatars.githubusercontent.com/u/405910?v=4"},"body":"If you want to GPG sign all your commits, you have to add the -S option\nall the time. The commit.gpgsign config option allows to sign all\ncommits automatically.\n\nSigned-off-by: Nicolas Vigier <boklm@mars-attacks.org>\n---\n Documentation/config.txt | 3 +++\n builtin/commit-tree.c    | 7 ++++++-\n builtin/commit.c         | 4 ++++\n builtin/merge.c          | 3 +++\n 4 files changed, 16 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex ab26963d6187..4cfa557375a2 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -988,6 +988,9 @@ commit.cleanup::\n \thave to remove the help lines that begin with `#` in the commit log\n \ttemplate yourself, if you do this).\n \n+commit.gpgsign::\n+\tA boolean to specify whether all commits should be GPG signed.\n+\n commit.status::\n \tA boolean to enable/disable inclusion of status information in the\n \tcommit message template when using an editor to prepare the commit\ndiff --git a/builtin/commit-tree.c b/builtin/commit-tree.c\nindex f641ff2a898c..1646d5b25e4f 100644\n--- a/builtin/commit-tree.c\n+++ b/builtin/commit-tree.c\n@@ -12,6 +12,8 @@\n \n static const char commit_tree_usage[] = \"git commit-tree [(-p <sha1>)...] [-S[<keyid>]] [-m <message>] [-F <file>] <sha1> <changelog\";\n \n+static const char *sign_commit;\n+\n static void new_parent(struct commit *parent, struct commit_list **parents_p)\n {\n \tunsigned char *sha1 = parent->object.sha1;\n@@ -31,6 +33,10 @@ static int commit_tree_config(const char *var, const char *value, void *cb)\n \tint status = git_gpg_config(var, value, NULL);\n \tif (status)\n \t\treturn status;\n+\tif (!strcmp(var, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(var, value) ? \"\" : NULL;\n+\t\treturn 0;\n+\t}\n \treturn git_default_config(var, value, cb);\n }\n \n@@ -41,7 +47,6 @@ int cmd_commit_tree(int argc, const char **argv, const char *prefix)\n \tunsigned char tree_sha1[20];\n \tunsigned char commit_sha1[20];\n \tstruct strbuf buffer = STRBUF_INIT;\n-\tconst char *sign_commit = NULL;\n \n \tgit_config(commit_tree_config, NULL);\n \ndiff --git a/builtin/commit.c b/builtin/commit.c\nindex 6ab4605cf5c2..cffddf210807 100644\n--- a/builtin/commit.c\n+++ b/builtin/commit.c\n@@ -1406,6 +1406,10 @@ static int git_commit_config(const char *k, const char *v, void *cb)\n \t}\n \tif (!strcmp(k, \"commit.cleanup\"))\n \t\treturn git_config_string(&cleanup_arg, k, v);\n+\tif (!strcmp(k, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n+\t\treturn 0;\n+\t}\n \n \tstatus = git_gpg_config(k, v, NULL);\n \tif (status)\ndiff --git a/builtin/merge.c b/builtin/merge.c\nindex 02a69c14e6ab..fea27244557d 100644\n--- a/builtin/merge.c\n+++ b/builtin/merge.c\n@@ -604,6 +604,9 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n \t} else if (!strcmp(k, \"merge.defaulttoupstream\")) {\n \t\tdefault_to_upstream = git_config_bool(k, v);\n \t\treturn 0;\n+\t} else if (!strcmp(k, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n+\t\treturn 0;\n \t}\n \n \tstatus = fmt_merge_msg_config(k, v, cb);\n-- \n1.8.4.2\n"},{"id":"230101","messageId":"xmqqppqfag2e.fsf@gitster.dls.corp.google.com","threadId":"35279","inReplyTo":"1383606881-2979-1-git-send-email-boklm@mars-attacks.org","subject":"Re: [PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-11-04T23:43:37Z","receivedAt":"2013-11-04T23:43:37Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Nicolas Vigier <boklm@mars-attacks.org> writes:\n\n> If you want to GPG sign all your commits, you have to add the -S option\n> all the time. The commit.gpgsign config option allows to sign all\n> commits automatically.\n\nI'm somewhat horrified to imagine the end-user experience this\n\"feature\" adds to the system; if one sets htis configuration and\nthen runs \"git rebase\" or anything that internally creates or\nrecreates commits, does one have to sign each and every commit, even\nif such a rebase was done merely as a trial run to see if a topic\ncan be rebased to an older codebase, or something?\n\n>\n> Signed-off-by: Nicolas Vigier <boklm@mars-attacks.org>\n> ---\n>  Documentation/config.txt | 3 +++\n>  builtin/commit-tree.c    | 7 ++++++-\n>  builtin/commit.c         | 4 ++++\n>  builtin/merge.c          | 3 +++\n>  4 files changed, 16 insertions(+), 1 deletion(-)\n>\n> diff --git a/Documentation/config.txt b/Documentation/config.txt\n> index ab26963d6187..4cfa557375a2 100644\n> --- a/Documentation/config.txt\n> +++ b/Documentation/config.txt\n> @@ -988,6 +988,9 @@ commit.cleanup::\n>  \thave to remove the help lines that begin with `#` in the commit log\n>  \ttemplate yourself, if you do this).\n>  \n> +commit.gpgsign::\n> +\tA boolean to specify whether all commits should be GPG signed.\n> +\n>  commit.status::\n>  \tA boolean to enable/disable inclusion of status information in the\n>  \tcommit message template when using an editor to prepare the commit\n> diff --git a/builtin/commit-tree.c b/builtin/commit-tree.c\n> index f641ff2a898c..1646d5b25e4f 100644\n> --- a/builtin/commit-tree.c\n> +++ b/builtin/commit-tree.c\n> @@ -12,6 +12,8 @@\n>  \n>  static const char commit_tree_usage[] = \"git commit-tree [(-p <sha1>)...] [-S[<keyid>]] [-m <message>] [-F <file>] <sha1> <changelog\";\n>  \n> +static const char *sign_commit;\n> +\n>  static void new_parent(struct commit *parent, struct commit_list **parents_p)\n>  {\n>  \tunsigned char *sha1 = parent->object.sha1;\n> @@ -31,6 +33,10 @@ static int commit_tree_config(const char *var, const char *value, void *cb)\n>  \tint status = git_gpg_config(var, value, NULL);\n>  \tif (status)\n>  \t\treturn status;\n> +\tif (!strcmp(var, \"commit.gpgsign\")) {\n> +\t\tsign_commit = git_config_bool(var, value) ? \"\" : NULL;\n> +\t\treturn 0;\n> +\t}\n>  \treturn git_default_config(var, value, cb);\n>  }\n>  \n> @@ -41,7 +47,6 @@ int cmd_commit_tree(int argc, const char **argv, const char *prefix)\n>  \tunsigned char tree_sha1[20];\n>  \tunsigned char commit_sha1[20];\n>  \tstruct strbuf buffer = STRBUF_INIT;\n> -\tconst char *sign_commit = NULL;\n>  \n>  \tgit_config(commit_tree_config, NULL);\n>  \n> diff --git a/builtin/commit.c b/builtin/commit.c\n> index 6ab4605cf5c2..cffddf210807 100644\n> --- a/builtin/commit.c\n> +++ b/builtin/commit.c\n> @@ -1406,6 +1406,10 @@ static int git_commit_config(const char *k, const char *v, void *cb)\n>  \t}\n>  \tif (!strcmp(k, \"commit.cleanup\"))\n>  \t\treturn git_config_string(&cleanup_arg, k, v);\n> +\tif (!strcmp(k, \"commit.gpgsign\")) {\n> +\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n> +\t\treturn 0;\n> +\t}\n>  \n>  \tstatus = git_gpg_config(k, v, NULL);\n>  \tif (status)\n> diff --git a/builtin/merge.c b/builtin/merge.c\n> index 02a69c14e6ab..fea27244557d 100644\n> --- a/builtin/merge.c\n> +++ b/builtin/merge.c\n> @@ -604,6 +604,9 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n>  \t} else if (!strcmp(k, \"merge.defaulttoupstream\")) {\n>  \t\tdefault_to_upstream = git_config_bool(k, v);\n>  \t\treturn 0;\n> +\t} else if (!strcmp(k, \"commit.gpgsign\")) {\n> +\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n> +\t\treturn 0;\n>  \t}\n>  \n>  \tstatus = fmt_merge_msg_config(k, v, cb);\n"},{"id":"230105","messageId":"20131105000330.GY4589@mars-attacks.org","threadId":"35279","inReplyTo":"xmqqppqfag2e.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Nicolas Vigier","fromEmail":"boklm@mars-attacks.org","sentAt":"2013-11-05T00:03:30Z","receivedAt":"2013-11-05T00:03:30Z","isPatch":true,"sender":{"key":"boklm@mars-attacks.org","avatar":"https://avatars.githubusercontent.com/u/405910?v=4"},"body":"On Mon, 04 Nov 2013, Junio C Hamano wrote:\n\n> Nicolas Vigier <boklm@mars-attacks.org> writes:\n> \n> > If you want to GPG sign all your commits, you have to add the -S option\n> > all the time. The commit.gpgsign config option allows to sign all\n> > commits automatically.\n> \n> I'm somewhat horrified to imagine the end-user experience this\n> \"feature\" adds to the system; if one sets htis configuration and\n> then runs \"git rebase\" or anything that internally creates or\n> recreates commits, does one have to sign each and every commit, even\n> if such a rebase was done merely as a trial run to see if a topic\n> can be rebased to an older codebase, or something?\n\nYes, all rebased commits will be signed, even if it was done as a trial\nrun. But I don't see this as a problem. The signature indicate who did\nthe rebase.\n"},{"id":"230104","messageId":"20131105000346.GC183446@vauxhall.crustytoothpaste.net","threadId":"35279","inReplyTo":"xmqqppqfag2e.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH] Add the commit.gpgsign option to sign all commits","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2013-11-05T00:03:46Z","receivedAt":"2013-11-05T00:03:46Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Mon, Nov 04, 2013 at 03:43:37PM -0800, Junio C Hamano wrote:\n> Nicolas Vigier <boklm@mars-attacks.org> writes:\n> \n> > If you want to GPG sign all your commits, you have to add the -S option\n> > all the time. The commit.gpgsign config option allows to sign all\n> > commits automatically.\n> \n> I'm somewhat horrified to imagine the end-user experience this\n> \"feature\" adds to the system; if one sets htis configuration and\n> then runs \"git rebase\" or anything that internally creates or\n> recreates commits, does one have to sign each and every commit, even\n> if such a rebase was done merely as a trial run to see if a topic\n> can be rebased to an older codebase, or something?\n\nProbably so, but you can use an agent so this happens automatically.\nIt's not very useful for people who don't use an agent.\n\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187\n"},{"id":"230116","messageId":"20131105112840.GZ4589@mars-attacks.org","threadId":"35279","inReplyTo":"xmqqppqfag2e.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Nicolas Vigier","fromEmail":"boklm@mars-attacks.org","sentAt":"2013-11-05T11:28:40Z","receivedAt":"2013-11-05T11:28:40Z","isPatch":true,"sender":{"key":"boklm@mars-attacks.org","avatar":"https://avatars.githubusercontent.com/u/405910?v=4"},"body":"On Mon, 04 Nov 2013, Junio C Hamano wrote:\n\n> Nicolas Vigier <boklm@mars-attacks.org> writes:\n> \n> > If you want to GPG sign all your commits, you have to add the -S option\n> > all the time. The commit.gpgsign config option allows to sign all\n> > commits automatically.\n> \n> I'm somewhat horrified to imagine the end-user experience this\n> \"feature\" adds to the system; if one sets htis configuration and\n> then runs \"git rebase\" or anything that internally creates or\n> recreates commits, does one have to sign each and every commit, even\n> if such a rebase was done merely as a trial run to see if a topic\n> can be rebased to an older codebase, or something?\n\nIf the problem is users having to type their passphrase to sign each\ncommit, we can suggest using an agent in the option description :\n\n  commit.gpgsign::\n\tA boolean to specify whether all commits should be GPG signed.\n\tUse of this option when doing operations such as rebase can\n\tresult in a large number of commits being signed. It is therefore\n\tconvenient to use an agent to avoid typing your gpg passphrase\n\tseveral times.\n\n\nAn example of why someone might want to use this option is :\n\nYou use git to store deployement scripts for some servers. Those\nservers have a cron job that pull from the git repository and run the\nscripts as root. Anyone with root access on the server hosting the git\nrepository can then gain root access to all your servers quite easily.\nYou want to avoid this, so you decide that all commits should be gpg\nsigned, and your servers will now do \"git pull --verify-signatures\".\nPeople who work on this repository will want to set \"commit.gpgsign\"\nso they don't have to add the -S option all the time.\n"},{"id":"230122","messageId":"xmqqhabqaclb.fsf@gitster.dls.corp.google.com","threadId":"35279","inReplyTo":"20131105112840.GZ4589@mars-attacks.org","subject":"Re: [PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-11-05T19:10:56Z","receivedAt":"2013-11-05T19:10:56Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Nicolas Vigier <boklm@mars-attacks.org> writes:\n\n> If the problem is users having to type their passphrase to sign each\n> commit, we can suggest using an agent in the option description:\n\nYeah, that is probably a good idea.\n"},{"id":"230150","messageId":"1383766022-16228-1-git-send-email-boklm@mars-attacks.org","threadId":"35279","inReplyTo":"xmqqhabqaclb.fsf@gitster.dls.corp.google.com","subject":"[PATCH] Add the commit.gpgsign option to sign all commits","fromName":"Nicolas Vigier","fromEmail":"boklm@mars-attacks.org","sentAt":"2013-11-06T19:27:02Z","receivedAt":"2013-11-06T19:27:02Z","isPatch":true,"sender":{"key":"boklm@mars-attacks.org","avatar":"https://avatars.githubusercontent.com/u/405910?v=4"},"body":"If you want to GPG sign all your commits, you have to add the -S option\nall the time. The commit.gpgsign config option allows to sign all\ncommits automatically.\n\nSigned-off-by: Nicolas Vigier <boklm@mars-attacks.org>\n---\nThe option description now suggests using an agent.\n\n Documentation/config.txt | 7 +++++++\n builtin/commit-tree.c    | 7 ++++++-\n builtin/commit.c         | 4 ++++\n builtin/merge.c          | 3 +++\n 4 files changed, 20 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex ab26963d6187..ffaa37752a39 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -988,6 +988,13 @@ commit.cleanup::\n \thave to remove the help lines that begin with `#` in the commit log\n \ttemplate yourself, if you do this).\n \n+commit.gpgsign::\n+\tA boolean to specify whether all commits should be GPG signed.\n+\tUse of this option when doing operations such as rebase can\n+\tresult in a large number of commits being signed. It is therefore\n+\tconvenient to use an agent to avoid typing your gpg passphrase\n+\tseveral times.\n+\n commit.status::\n \tA boolean to enable/disable inclusion of status information in the\n \tcommit message template when using an editor to prepare the commit\ndiff --git a/builtin/commit-tree.c b/builtin/commit-tree.c\nindex f641ff2a898c..1646d5b25e4f 100644\n--- a/builtin/commit-tree.c\n+++ b/builtin/commit-tree.c\n@@ -12,6 +12,8 @@\n \n static const char commit_tree_usage[] = \"git commit-tree [(-p <sha1>)...] [-S[<keyid>]] [-m <message>] [-F <file>] <sha1> <changelog\";\n \n+static const char *sign_commit;\n+\n static void new_parent(struct commit *parent, struct commit_list **parents_p)\n {\n \tunsigned char *sha1 = parent->object.sha1;\n@@ -31,6 +33,10 @@ static int commit_tree_config(const char *var, const char *value, void *cb)\n \tint status = git_gpg_config(var, value, NULL);\n \tif (status)\n \t\treturn status;\n+\tif (!strcmp(var, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(var, value) ? \"\" : NULL;\n+\t\treturn 0;\n+\t}\n \treturn git_default_config(var, value, cb);\n }\n \n@@ -41,7 +47,6 @@ int cmd_commit_tree(int argc, const char **argv, const char *prefix)\n \tunsigned char tree_sha1[20];\n \tunsigned char commit_sha1[20];\n \tstruct strbuf buffer = STRBUF_INIT;\n-\tconst char *sign_commit = NULL;\n \n \tgit_config(commit_tree_config, NULL);\n \ndiff --git a/builtin/commit.c b/builtin/commit.c\nindex 6ab4605cf5c2..cffddf210807 100644\n--- a/builtin/commit.c\n+++ b/builtin/commit.c\n@@ -1406,6 +1406,10 @@ static int git_commit_config(const char *k, const char *v, void *cb)\n \t}\n \tif (!strcmp(k, \"commit.cleanup\"))\n \t\treturn git_config_string(&cleanup_arg, k, v);\n+\tif (!strcmp(k, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n+\t\treturn 0;\n+\t}\n \n \tstatus = git_gpg_config(k, v, NULL);\n \tif (status)\ndiff --git a/builtin/merge.c b/builtin/merge.c\nindex 02a69c14e6ab..fea27244557d 100644\n--- a/builtin/merge.c\n+++ b/builtin/merge.c\n@@ -604,6 +604,9 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n \t} else if (!strcmp(k, \"merge.defaulttoupstream\")) {\n \t\tdefault_to_upstream = git_config_bool(k, v);\n \t\treturn 0;\n+\t} else if (!strcmp(k, \"commit.gpgsign\")) {\n+\t\tsign_commit = git_config_bool(k, v) ? \"\" : NULL;\n+\t\treturn 0;\n \t}\n \n \tstatus = fmt_merge_msg_config(k, v, cb);\n-- \n1.8.4.2\n"}]}