{"thread":{"id":"40338","subject":"[PATCH] hooks/update: Add a hooks.denyunsignedtags option","startedAt":"2015-09-12T10:37:33Z","lastAt":"2015-09-22T18:42:21Z","messageCount":3,"participants":["Julian Andres Klode"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"269822","messageId":"1442054253-15780-1-git-send-email-jak@debian.org","threadId":"40338","inReplyTo":null,"subject":"[PATCH] hooks/update: Add a hooks.denyunsignedtags option","fromName":"Julian Andres Klode","fromEmail":"jak@debian.org","sentAt":"2015-09-12T10:37:33Z","receivedAt":"2015-09-12T10:37:33Z","isPatch":true,"sender":{"key":"jak@debian.org","avatar":"https://gravatar.com/avatar/a40fab460f7ba7f2f9354b222828a522daf583d38fd1aa792131b6a479fa85f6?d=mp&s=160"},"body":"Introduce an option to deny unsigned tags from entering\na repository. This is useful in teams where members forget\nto sign their release tags.\n\nIt does not actually check whether the signature is actually\ncomplete or valid, it just checks for the beginning of a\nsignature, as further checks would be too involved.\n\nThis effectively also denies un-annotated tags, as those\nare unsigned by definition.\n\nSigned-off-by: Julian Andres Klode <jak@debian.org>\n---\n templates/hooks--update.sample | 14 +++++++++++++-\n 1 file changed, 13 insertions(+), 1 deletion(-)\n\ndiff --git a/templates/hooks--update.sample b/templates/hooks--update.sample\nindex d847583..5a0460f 100755\n--- a/templates/hooks--update.sample\n+++ b/templates/hooks--update.sample\n@@ -16,6 +16,9 @@\n # hooks.allowmodifytag\n #   This boolean sets whether a tag may be modified after creation. By default\n #   it won't be.\n+# hooks.denyunsignedtag\n+#   This boolean sets whether creating unsigned tags will be denied. By\n+#   default this is allowed.\n # hooks.allowdeletebranch\n #   This boolean sets whether deleting branches will be allowed in the\n #   repository.  By default they won't be.\n@@ -48,6 +51,7 @@ allowdeletebranch=$(git config --bool hooks.allowdeletebranch)\n denycreatebranch=$(git config --bool hooks.denycreatebranch)\n allowdeletetag=$(git config --bool hooks.allowdeletetag)\n allowmodifytag=$(git config --bool hooks.allowmodifytag)\n+denyunsignedtag=$(git config --bool hooks.denyunsignedtag)\n \n # check for no description\n projectdesc=$(sed -e '1q' \"$GIT_DIR/description\")\n@@ -71,7 +75,7 @@ case \"$refname\",\"$newrev_type\" in\n \trefs/tags/*,commit)\n \t\t# un-annotated tag\n \t\tshort_refname=${refname##refs/tags/}\n-\t\tif [ \"$allowunannotated\" != \"true\" ]; then\n+\t\tif [ \"$allowunannotated\" != \"true\" ] || [ \"$denyunsignedtag\" = \"true\" ]; then\n \t\t\techo \"*** The un-annotated tag, $short_refname, is not allowed in this repository\" >&2\n \t\t\techo \"*** Use 'git tag [ -a | -s ]' for tags you want to propagate.\" >&2\n \t\t\texit 1\n@@ -86,6 +90,14 @@ case \"$refname\",\"$newrev_type\" in\n \t\t;;\n \trefs/tags/*,tag)\n \t\t# annotated tag\n+\t\tif [ \"$denyunsignedtag\" != \"true\" ] || git cat-file -p $newrev | grep -q 'BEGIN PGP SIGNATURE'; then\n+\t\t\t:\n+\t\telse\n+\t\t\techo \"*** Tag '$refname' is unsigned\"\n+\t\t\techo \"*** Unsigned tags are not allowed in this repository.\" >&2\n+\t                exit 1\n+\t\tfi\n+\n \t\tif [ \"$allowmodifytag\" != \"true\" ] && git rev-parse $refname > /dev/null 2>&1\n \t\tthen\n \t\t\techo \"*** Tag '$refname' already exists.\" >&2\n-- \n2.5.1\n"},{"id":"269823","messageId":"20150912123905.GA15958@debian.org","threadId":"40338","inReplyTo":"1442054253-15780-1-git-send-email-jak@debian.org","subject":"Re: [PATCH] hooks/update: Add a hooks.denyunsignedtags option","fromName":"Julian Andres Klode","fromEmail":"jak@debian.org","sentAt":"2015-09-12T10:40:32Z","receivedAt":"2015-09-12T10:40:32Z","isPatch":true,"sender":{"key":"jak@debian.org","avatar":"https://gravatar.com/avatar/a40fab460f7ba7f2f9354b222828a522daf583d38fd1aa792131b6a479fa85f6?d=mp&s=160"},"body":"On Sat, Sep 12, 2015 at 12:37:33PM +0200, Julian Andres Klode wrote:\n> Introduce an option to deny unsigned tags from entering\n> a repository. This is useful in teams where members forget\n> to sign their release tags.\n> \n> It does not actually check whether the signature is actually\n> complete or valid, it just checks for the beginning of a\n> signature, as further checks would be too involved.\n> \n> This effectively also denies un-annotated tags, as those\n> are unsigned by definition.\n> \n> Signed-off-by: Julian Andres Klode <jak@debian.org>\n> ---\n>  templates/hooks--update.sample | 14 +++++++++++++-\n>  1 file changed, 13 insertions(+), 1 deletion(-)\n> \n[...]\n> @@ -86,6 +90,14 @@ case \"$refname\",\"$newrev_type\" in\n>  \t\t;;\n>  \trefs/tags/*,tag)\n>  \t\t# annotated tag\n> +\t\tif [ \"$denyunsignedtag\" != \"true\" ] || git cat-file -p $newrev | grep -q 'BEGIN PGP SIGNATURE'; then\n> +\t\t\t:\n> +\t\telse\n> +\t\t\techo \"*** Tag '$refname' is unsigned\"\n> +\t\t\techo \"*** Unsigned tags are not allowed in this repository.\" >&2\n> +\t                exit 1\n\nThere are some accidental space characters in front of that, this is fixed locally\nalready. Sorry.\n\n-- \nJulian Andres Klode  - Debian Developer, Ubuntu Member\n\nSee http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.\n\nBe friendly, do not top-post, and follow RFC 1855 \"Netiquette\".\n    - If you don't I might ignore you.\n"},{"id":"270508","messageId":"20150922204203.GA6573@debian.org","threadId":"40338","inReplyTo":"1442054253-15780-1-git-send-email-jak@debian.org","subject":"Re: [PATCH] hooks/update: Add a hooks.denyunsignedtags option","fromName":"Julian Andres Klode","fromEmail":"jak@debian.org","sentAt":"2015-09-22T18:42:21Z","receivedAt":"2015-09-22T18:42:21Z","isPatch":true,"sender":{"key":"jak@debian.org","avatar":"https://gravatar.com/avatar/a40fab460f7ba7f2f9354b222828a522daf583d38fd1aa792131b6a479fa85f6?d=mp&s=160"},"body":"On Sat, Sep 12, 2015 at 12:37:33PM +0200, Julian Andres Klode wrote:\n> Introduce an option to deny unsigned tags from entering\n> a repository. This is useful in teams where members forget\n> to sign their release tags.\n> \n> It does not actually check whether the signature is actually\n> complete or valid, it just checks for the beginning of a\n> signature, as further checks would be too involved.\n> \n> This effectively also denies un-annotated tags, as those\n> are unsigned by definition.\n\nNo comments?\n\n-- \nJulian Andres Klode  - Debian Developer, Ubuntu Member\n\nSee http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.\n\nBe friendly, do not top-post, and follow RFC 1855 \"Netiquette\".\n    - If you don't I might ignore you.\n"}]}