{"thread":{"id":"47038","subject":"[PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","startedAt":"2017-10-26T20:04:36Z","lastAt":"2017-10-28T17:17:29Z","messageCount":7,"participants":["Tigran Mkrtchyan","Jonathan Nieder","Mkrtchyan, Tigran","Stefan Beller","brian m. carlson"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"331110","messageId":"20171026195516.3354-1-tigran.mkrtchyan@desy.de","threadId":"47038","inReplyTo":null,"subject":"[PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Tigran Mkrtchyan","fromEmail":"tigran.mkrtchyan@desy.de","sentAt":"2017-10-26T19:55:16Z","receivedAt":"2017-10-26T20:04:36Z","isPatch":true,"sender":{"key":"tigran.mkrtchyan@desy.de","avatar":"https://avatars.githubusercontent.com/u/575965?v=4"},"body":"In some workflows we have no control on how git command is executed,\nhowever a signed tags are required.\n\nThe new config-file option tag.gpgSign enforces signed tags. Additional\ncommand line option --no-gpg-sign is added to disable such behavior if\nneeded. E.g.:\n\n    $ git tag -m \"commit message\"\n\nwill generate a GPG signed tag if tag.gpgSign option is true, while\n\n    $ git tag --no-gpg-sign -m \"commit message\"\n\nwill skip the signing step.\n\nSigned-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>\n---\n Documentation/config.txt               |  4 ++++\n Documentation/git-tag.txt              |  4 ++++\n builtin/tag.c                          | 18 +++++++++++++++---\n contrib/completion/git-completion.bash |  1 +\n t/t7004-tag.sh                         | 21 +++++++++++++++++++++\n 5 files changed, 45 insertions(+), 3 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 1ac0ae6ad..fa6694bec 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -3161,6 +3161,10 @@ tag.forceSignAnnotated::\n \tIf `--annotate` is specified on the command line, it takes\n \tprecedence over this option.\n \n+tag.gpgSign::\n+\n+\tA boolean to specify whether all tags should be GPG signed.\n+\n tag.sort::\n \tThis variable controls the sort ordering of tags when displayed by\n \tlinkgit:git-tag[1]. Without the \"--sort=<value>\" option provided, the\ndiff --git a/Documentation/git-tag.txt b/Documentation/git-tag.txt\nindex 956fc019f..1dd43f18b 100644\n--- a/Documentation/git-tag.txt\n+++ b/Documentation/git-tag.txt\n@@ -181,6 +181,10 @@ This option is only applicable when listing tags without annotation lines.\n \t`--create-reflog`, but currently does not negate the setting of\n \t`core.logAllRefUpdates`.\n \n+--no-gpg-sign::\n+\tCountermand `tag.gpgSign` configuration variable that is\n+\tset to force each and every tag to be signed.\n+\n <tagname>::\n \tThe name of the tag to create, delete, or describe.\n \tThe new tag name must pass all checks defined by\ndiff --git a/builtin/tag.c b/builtin/tag.c\nindex b38329b59..d9060a404 100644\n--- a/builtin/tag.c\n+++ b/builtin/tag.c\n@@ -31,6 +31,7 @@ static const char * const git_tag_usage[] = {\n \n static unsigned int colopts;\n static int force_sign_annotate;\n+static int sign_tag;\n \n static int list_tags(struct ref_filter *filter, struct ref_sorting *sorting,\n \t\t     struct ref_format *format)\n@@ -141,6 +142,11 @@ static int git_tag_config(const char *var, const char *value, void *cb)\n \tint status;\n \tstruct ref_sorting **sorting_tail = (struct ref_sorting **)cb;\n \n+\tif (!strcmp(var, \"tag.gpgsign\")) {\n+\t\tsign_tag = git_config_bool(var, value);\n+\t\treturn 0;\n+\t}\n+\n \tif (!strcmp(var, \"tag.sort\")) {\n \t\tif (!value)\n \t\t\treturn config_error_nonbool(var);\n@@ -372,6 +378,7 @@ int cmd_tag(int argc, const char **argv, const char *prefix)\n \tstatic struct ref_sorting *sorting = NULL, **sorting_tail = &sorting;\n \tstruct ref_format format = REF_FORMAT_INIT;\n \tint icase = 0;\n+\tint no_gpg_sign = 0;\n \tstruct option options[] = {\n \t\tOPT_CMDMODE('l', \"list\", &cmdmode, N_(\"list tag names\"), 'l'),\n \t\t{ OPTION_INTEGER, 'n', NULL, &filter.lines, N_(\"n\"),\n@@ -393,6 +400,7 @@ int cmd_tag(int argc, const char **argv, const char *prefix)\n \t\t\t\t\tN_(\"use another key to sign the tag\")),\n \t\tOPT__FORCE(&force, N_(\"replace the tag if exists\")),\n \t\tOPT_BOOL(0, \"create-reflog\", &create_reflog, N_(\"create a reflog\")),\n+\t\tOPT_BOOL(0, \"no-gpg-sign\", &no_gpg_sign, N_(\"do not GPG-sign tag\")),\n \n \t\tOPT_GROUP(N_(\"Tag listing options\")),\n \t\tOPT_COLUMN(0, \"column\", &colopts, N_(\"show tag list in columns\")),\n@@ -426,6 +434,10 @@ int cmd_tag(int argc, const char **argv, const char *prefix)\n \n \targc = parse_options(argc, argv, prefix, options, git_tag_usage, 0);\n \n+\tif (no_gpg_sign) {\n+\t\tsign_tag = 0;\n+\t}\n+\n \tif (keyid) {\n \t\topt.sign = 1;\n \t\tset_signing_key(keyid);\n@@ -444,7 +456,7 @@ int cmd_tag(int argc, const char **argv, const char *prefix)\n \tif (cmdmode == 'l')\n \t\tsetup_auto_pager(\"tag\", 1);\n \n-\tif ((create_tag_object || force) && (cmdmode != 0))\n+\tif ((create_tag_object || force || no_gpg_sign) && (cmdmode != 0))\n \t\tusage_with_options(git_tag_usage, options);\n \n \tfinalize_colopts(&colopts, -1);\n@@ -536,8 +548,8 @@ int cmd_tag(int argc, const char **argv, const char *prefix)\n \n \tcreate_reflog_msg(&object, &reflog_msg);\n \n-\tif (create_tag_object) {\n-\t\tif (force_sign_annotate && !annotate)\n+\tif (create_tag_object || sign_tag) {\n+\t\tif (sign_tag || (force_sign_annotate && !annotate))\n \t\t\topt.sign = 1;\n \t\tcreate_tag(&object, tag, &buf, &opt, &prev, &object);\n \t}\ndiff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\nindex 0e16f017a..0dbe689a2 100644\n--- a/contrib/completion/git-completion.bash\n+++ b/contrib/completion/git-completion.bash\n@@ -2648,6 +2648,7 @@ _git_config ()\n \t\tstatus.showUntrackedFiles\n \t\tstatus.submodulesummary\n \t\tsubmodule.\n+\t\ttag.gpgSign\n \t\ttar.umask\n \t\ttransfer.unpackLimit\n \t\turl.\ndiff --git a/t/t7004-tag.sh b/t/t7004-tag.sh\nindex a9af2de99..ccff37733 100755\n--- a/t/t7004-tag.sh\n+++ b/t/t7004-tag.sh\n@@ -904,6 +904,27 @@ test_expect_success GPG \\\n \ttest_cmp expect actual\n '\n \n+get_tag_header gpgsign-enabled $commit commit $time >expect\n+echo \"A message\" >>expect\n+echo '-----BEGIN PGP SIGNATURE-----' >>expect\n+test_expect_success GPG \\\n+\t'git tag configured tag.gpgsign enables GPG sign' \\\n+\t'test_config tag.gpgsign true &&\n+\tgit tag -m \"A message\" gpgsign-enabled &&\n+\tget_tag_msg gpgsign-enabled>actual &&\n+\ttest_cmp expect actual\n+'\n+\n+get_tag_header no-gpg-sign $commit commit $time >expect\n+echo \"A message\" >>expect\n+test_expect_success GPG \\\n+\t'git tag --no-gpg-sign configured tag.gpgsign skip GPG sign' \\\n+\t'test_config tag.gpgsign true &&\n+\tgit tag -a --no-gpg-sign -m \"A message\" no-gpg-sign &&\n+\tget_tag_msg no-gpg-sign>actual &&\n+\ttest_cmp expect actual\n+'\n+\n test_expect_success GPG \\\n \t'trying to create a signed tag with non-existing -F file should fail' '\n \t! test -f nonexistingfile &&\n-- \n2.13.6\n\n"},{"id":"331118","messageId":"20171026205509.2ydjd3bai2l6pqxi@aiede.mtv.corp.google.com","threadId":"47038","inReplyTo":"20171026195516.3354-1-tigran.mkrtchyan@desy.de","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2017-10-26T20:55:09Z","receivedAt":"2017-10-26T20:55:16Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi,\n\nTigran Mkrtchyan wrote:\n\n> In some workflows we have no control on how git command is executed,\n> however a signed tags are required.\n\nDon't leave me hanging: this leaves me super curious.  Can you tell me\nmore about these workflows?\n\nThanks and hope that helps,\nJonathan\n"},{"id":"331119","messageId":"1113033991.3307260.1509051676201.JavaMail.zimbra@desy.de","threadId":"47038","inReplyTo":"20171026205509.2ydjd3bai2l6pqxi@aiede.mtv.corp.google.com","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Mkrtchyan, Tigran","fromEmail":"tigran.mkrtchyan@desy.de","sentAt":"2017-10-26T21:01:16Z","receivedAt":"2017-10-26T21:01:22Z","isPatch":true,"sender":{"key":"tigran.mkrtchyan@desy.de","avatar":"https://avatars.githubusercontent.com/u/575965?v=4"},"body":"Well, this is a build/release process where we can't pass additional\ncommand line options to git. TO be hones, is case of annotated tags\nthere is already option tag.forceSignAnnotated. However, non annotated\ntags are not forced to be signed.\n\nAdditionally, the proposed option is symmetric with commit.gpgSign.\n\nTigran.\n\n----- Original Message -----\n> From: \"Jonathan Nieder\" <jrnieder@gmail.com>\n> To: \"Tigran Mkrtchyan\" <tigran.mkrtchyan@desy.de>\n> Cc: git@vger.kernel.org\n> Sent: Thursday, October 26, 2017 10:55:09 PM\n> Subject: Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed\n\n> Hi,\n> \n> Tigran Mkrtchyan wrote:\n> \n>> In some workflows we have no control on how git command is executed,\n>> however a signed tags are required.\n> \n> Don't leave me hanging: this leaves me super curious.  Can you tell me\n> more about these workflows?\n> \n> Thanks and hope that helps,\n> Jonathan\n"},{"id":"331122","messageId":"20171026213337.kbmwnaxlsyubat4w@aiede.mtv.corp.google.com","threadId":"47038","inReplyTo":"1113033991.3307260.1509051676201.JavaMail.zimbra@desy.de","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2017-10-26T21:33:37Z","receivedAt":"2017-10-26T21:33:45Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi again,\n\nMkrtchyan, Tigran wrote:\n> Jonathan Nieder wrote:\n>> Tigran Mkrtchyan wrote:\n\n>>> In some workflows we have no control on how git command is executed,\n>>> however a signed tags are required.\n>>\n>> Don't leave me hanging: this leaves me super curious.  Can you tell me\n>> more about these workflows?\n>\n> Well, this is a build/release process where we can't pass additional\n> command line options to git. TO be hones, is case of annotated tags\n> there is already option tag.forceSignAnnotated. However, non annotated\n> tags are not forced to be signed.\n>\n> Additionally, the proposed option is symmetric with commit.gpgSign.\n\nNow I'm even more curious.\n\nI don't think we have the full picture to understand whether this\nchange is needed.  When adding a configuration item, we need to be\nable to explain to users what the configuration item is for, and so\nfar the only answer I am hearing is \"because we do not want to patch\nour build/release script, though we could in principle\".  That doesn't\nsound like a compelling reason.\n\nOn the other hand, perhaps the answer is \"our build/release script\ndoes not have a --sign option for the following reason, and this is a\nbetter interface for configuring it\".\n\nOr perhaps there is an answer that does not involve the build/release\nscript.\n\nBut with no answer at all, it is hard to see why we should move\nforward on this patch.\n\nTo be clear, I am not saying that writing the patch is wasted effort.\nE.g. you can continue to use it internally, and it means that once we\nhave a clear reason to add this configuration, the patch is there and\nready to use to do so.\n\nThanks again,\nJonathan\n"},{"id":"331123","messageId":"CAGZ79kZahLWdYJ2poi1QhMKaMQDNiJmQFe+M50HM-TfPtOx_iw@mail.gmail.com","threadId":"47038","inReplyTo":"20171026213337.kbmwnaxlsyubat4w@aiede.mtv.corp.google.com","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2017-10-26T21:45:28Z","receivedAt":"2017-10-26T21:45:34Z","isPatch":true,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"On Thu, Oct 26, 2017 at 2:33 PM, Jonathan Nieder <jrnieder@gmail.com> wrote:\n> Hi again,\n>\n> Mkrtchyan, Tigran wrote:\n>> Jonathan Nieder wrote:\n>>> Tigran Mkrtchyan wrote:\n>\n>>>> In some workflows we have no control on how git command is executed,\n>>>> however a signed tags are required.\n>>>\n>>> Don't leave me hanging: this leaves me super curious.  Can you tell me\n>>> more about these workflows?\n>>\n>> Well, this is a build/release process where we can't pass additional\n>> command line options to git. TO be hones, is case of annotated tags\n>> there is already option tag.forceSignAnnotated. However, non annotated\n>> tags are not forced to be signed.\n>>\n>> Additionally, the proposed option is symmetric with commit.gpgSign.\n>\n> Now I'm even more curious.\n\nI started digging and found\nhttps://public-inbox.org/git/20131105112840.GZ4589@mars-attacks.org/\nwhich is an answer to \"Why do we have commit.gpgSign?\" which is\na very similar question to begin with.\n\nMaybe the answer is also similar (bonus points if the answer also touches\nwhen to prefer one over the other)?\n"},{"id":"331145","messageId":"760741736.3439901.1509090074292.JavaMail.zimbra@desy.de","threadId":"47038","inReplyTo":"20171026213337.kbmwnaxlsyubat4w@aiede.mtv.corp.google.com","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"Mkrtchyan, Tigran","fromEmail":"tigran.mkrtchyan@desy.de","sentAt":"2017-10-27T07:41:14Z","receivedAt":"2017-10-27T07:41:22Z","isPatch":true,"sender":{"key":"tigran.mkrtchyan@desy.de","avatar":"https://avatars.githubusercontent.com/u/575965?v=4"},"body":"Hi Jonathan,\n\nI can't disagree with you - the right solution is to fix the build/release process to support\nsigned tagging. It's just too many of them to fix: jenkins, maven, IDE, etc. My naive assumption\nwas that if a tool (git) has a switch to enable some functionality, why not have a possibility\nto make it default.\n\nYou can put this change on hold and re-consider it if more people will need such functionality.\n\nThanks,\n   Tigran.\n\n----- Original Message -----\n> From: \"Jonathan Nieder\" <jrnieder@gmail.com>\n> To: \"Tigran Mkrtchyan\" <tigran.mkrtchyan@desy.de>\n> Cc: \"git\" <git@vger.kernel.org>\n> Sent: Thursday, October 26, 2017 11:33:37 PM\n> Subject: Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed\n\n> Hi again,\n> \n> Mkrtchyan, Tigran wrote:\n>> Jonathan Nieder wrote:\n>>> Tigran Mkrtchyan wrote:\n> \n>>>> In some workflows we have no control on how git command is executed,\n>>>> however a signed tags are required.\n>>>\n>>> Don't leave me hanging: this leaves me super curious.  Can you tell me\n>>> more about these workflows?\n>>\n>> Well, this is a build/release process where we can't pass additional\n>> command line options to git. TO be hones, is case of annotated tags\n>> there is already option tag.forceSignAnnotated. However, non annotated\n>> tags are not forced to be signed.\n>>\n>> Additionally, the proposed option is symmetric with commit.gpgSign.\n> \n> Now I'm even more curious.\n> \n> I don't think we have the full picture to understand whether this\n> change is needed.  When adding a configuration item, we need to be\n> able to explain to users what the configuration item is for, and so\n> far the only answer I am hearing is \"because we do not want to patch\n> our build/release script, though we could in principle\".  That doesn't\n> sound like a compelling reason.\n> \n> On the other hand, perhaps the answer is \"our build/release script\n> does not have a --sign option for the following reason, and this is a\n> better interface for configuring it\".\n> \n> Or perhaps there is an answer that does not involve the build/release\n> script.\n> \n> But with no answer at all, it is hard to see why we should move\n> forward on this patch.\n> \n> To be clear, I am not saying that writing the patch is wasted effort.\n> E.g. you can continue to use it internally, and it means that once we\n> have a clear reason to add this configuration, the patch is there and\n> ready to use to do so.\n> \n> Thanks again,\n> Jonathan\n"},{"id":"331232","messageId":"20171028171715.42uka4w2x2zm6pit@genre.crustytoothpaste.net","threadId":"47038","inReplyTo":"20171026213337.kbmwnaxlsyubat4w@aiede.mtv.corp.google.com","subject":"Re: [PATCH] tag: add tag.gpgSign config option to force all tags be GPG-signed","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2017-10-28T17:17:15Z","receivedAt":"2017-10-28T17:17:29Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Thu, Oct 26, 2017 at 02:33:37PM -0700, Jonathan Nieder wrote:\n> Now I'm even more curious.\n> \n> I don't think we have the full picture to understand whether this\n> change is needed.  When adding a configuration item, we need to be\n> able to explain to users what the configuration item is for, and so\n> far the only answer I am hearing is \"because we do not want to patch\n> our build/release script, though we could in principle\".  That doesn't\n> sound like a compelling reason.\n> \n> On the other hand, perhaps the answer is \"our build/release script\n> does not have a --sign option for the following reason, and this is a\n> better interface for configuring it\".\n> \n> Or perhaps there is an answer that does not involve the build/release\n> script.\n\nI think this option is potentially quite useful.  Say we have a policy\nwhich requires signed tags for auditability reasons.  Shipping a\nstandard system-wide gitconfig to all systems with this option can be\nvery useful and is easier than relying on individuals remembering the\nrequired options.  Otherwise, somebody might create a lightweight tag\n(or an unsigned tag) and push it by accident, which would be hard to\nundo (because tags aren't overwritten).\n\nIn my open-source projects, I always want to create a signed tag, so I\nwould find this option useful.  The only time I want a lightweight tag\nis in creating ephemeral repositories, and I can script that into my\nalias.\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\nhttps://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: https://keybase.io/bk2204\n"}]}