{"thread":{"id":"47415","subject":"[PATCH 2/3] t: add tests for pull --verify-signatures","startedAt":"2017-12-09T09:06:09Z","lastAt":"2017-12-19T21:01:28Z","messageCount":15,"participants":["Hans Jerry Illikainen","Kevin Daudt","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":3},"messages":[{"id":"334530","messageId":"20171209090530.6747-2-hji@dyntopia.com","threadId":"47415","inReplyTo":"20171209090530.6747-1-hji@dyntopia.com","subject":"[PATCH 2/3] t: add tests for pull --verify-signatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-09T09:05:29Z","receivedAt":"2017-12-09T09:06:09Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"Add tests for `pull --verify-signatures` with untrusted, bad and no\nsignatures.  Previously the only test for `--verify-signatures` was to\nmake sure that `pull --rebase --verify-signatures` result in a warning\n(t5520-pull.sh).\n\nSigned-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n---\n t/t5573-pull-verify-signatures.sh | 78 +++++++++++++++++++++++++++++++++++++++\n 1 file changed, 78 insertions(+)\n create mode 100755 t/t5573-pull-verify-signatures.sh\n\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nnew file mode 100755\nindex 000000000..700247910\n--- /dev/null\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -0,0 +1,78 @@\n+#!/bin/sh\n+\n+test_description='pull signature verification tests'\n+. ./test-lib.sh\n+. \"$TEST_DIRECTORY/lib-gpg.sh\"\n+\n+test_expect_success GPG 'create repositories with signed commits' '\n+\techo 1 >a && git add a &&\n+\ttest_tick && git commit -m initial &&\n+\tgit tag initial &&\n+\n+\tgit clone . signed &&\n+\t(\n+\t\tcd signed &&\n+\t\techo 2 >b && git add b &&\n+\t\ttest_tick && git commit -S -m \"signed\"\n+\t) &&\n+\n+\tgit clone . unsigned &&\n+\t(\n+\t\tcd unsigned &&\n+\t\techo 3 >c && git add c &&\n+\t\ttest_tick && git commit -m \"unsigned\"\n+\t) &&\n+\n+\tgit clone . bad &&\n+\t(\n+\t\tcd bad &&\n+\t\techo 4 >d && git add d &&\n+\t\ttest_tick && git commit -S -m \"bad\" &&\n+\t\tgit cat-file commit HEAD >raw &&\n+\t\tsed -e \"s/bad/forged bad/\" raw >forged &&\n+\t\tgit hash-object -w -t commit forged >forged.commit &&\n+\t\tgit checkout $(cat forged.commit)\n+\t) &&\n+\n+\tgit clone . untrusted &&\n+\t(\n+\t\tcd untrusted &&\n+\t\techo 5 >e && git add e &&\n+\t\ttest_tick && git commit -SB7227189 -m \"untrusted\"\n+\t)\n+'\n+\n+test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n+\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n+\ttest_i18ngrep \"has a bad GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull signed commit with --verify-signatures' '\n+\tgit pull --verify-signatures signed >pulloutput &&\n+\ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n+\tgit checkout initial\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature without verification' '\n+\tgit pull --ff-only bad 2>pullerror &&\n+\tgit checkout initial\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_config pull.verifySignatures true &&\n+\tgit pull --ff-only --no-verify-signatures bad 2>pullerror &&\n+\tgit checkout initial\n+'\n+\n+test_done\n-- \n2.11.0\n\n"},{"id":"334531","messageId":"20171209090530.6747-3-hji@dyntopia.com","threadId":"47415","inReplyTo":"20171209090530.6747-1-hji@dyntopia.com","subject":"[PATCH 3/3] pull: add config option for verifySignatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-09T09:05:30Z","receivedAt":"2017-12-09T09:06:16Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"Verify the signature of the tip commit when `pull.verifySignatures` is\ntrue.  This option overrides `merge.verifySignatures` on pull, and can\nbe disabled with the option `--no-verify-signatures`.\n\nSigned-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n---\n Documentation/config.txt          |  8 ++++++++\n builtin/pull.c                    | 25 +++++++++++++++++++++++++\n t/t5520-pull.sh                   | 18 ++++++++++++++++++\n t/t5573-pull-verify-signatures.sh | 32 ++++++++++++++++++++++++++++++++\n 4 files changed, 83 insertions(+)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex c1598ee70..0cd2bc597 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -2596,6 +2596,14 @@ pull.ff::\n \tallowed (equivalent to giving the `--ff-only` option from the\n \tcommand line). This setting overrides `merge.ff` when pulling.\n \n+pull.verifySignatures::\n+\tVerify that the tip commit of the side branch being merged is\n+\tsigned with a valid key, i.e. a key that has a valid uid: in the\n+\tdefault trust model, this means the signing key has been signed\n+\tby a trusted key. If the tip commit of the side branch is not\n+\tsigned with a valid key, the merge is aborted. This setting\n+\toverrides `merge.verifySignatures` when pulling.\n+\n pull.rebase::\n \tWhen true, rebase branches on top of the fetched branch, instead\n \tof merging the default branch from the default remote when \"git\ndiff --git a/builtin/pull.c b/builtin/pull.c\nindex 166b777ed..791365915 100644\n--- a/builtin/pull.c\n+++ b/builtin/pull.c\n@@ -300,6 +300,28 @@ static const char *config_get_ff(void)\n }\n \n /**\n+ * If pull.verifySignatures is unset, returns NULL. If pull.verifySignatures is\n+ * \"true\", returns \"--verify-signatures\". If pull.verifySignatures is \"false\",\n+ * returns \"--no-verify-signatures\". Otherwise, die with an error.\n+ */\n+static const char *config_get_verify_signatures(void)\n+{\n+\tconst char *value;\n+\n+\tif (git_config_get_value(\"pull.verifysignatures\", &value))\n+\t\treturn NULL;\n+\n+\tswitch (git_parse_maybe_bool(value)) {\n+\tcase 0:\n+\t\treturn \"--no-verify-signatures\";\n+\tcase 1:\n+\t\treturn \"--verify-signatures\";\n+\tdefault:\n+\t\tdie(_(\"Invalid value for pull.verifysignatures: %s\"), value);\n+\t}\n+}\n+\n+/**\n  * Returns the default configured value for --rebase. It first looks for the\n  * value of \"branch.$curr_branch.rebase\", where $curr_branch is the current\n  * branch, and if HEAD is detached or the configuration key does not exist,\n@@ -849,6 +871,9 @@ int cmd_pull(int argc, const char **argv, const char *prefix)\n \tif (!opt_ff)\n \t\topt_ff = xstrdup_or_null(config_get_ff());\n \n+\tif (!opt_verify_signatures)\n+\t\topt_verify_signatures = xstrdup_or_null(config_get_verify_signatures());\n+\n \tif (opt_rebase < 0)\n \t\topt_rebase = config_get_rebase();\n \ndiff --git a/t/t5520-pull.sh b/t/t5520-pull.sh\nindex 59c4b778d..cdf1fd213 100755\n--- a/t/t5520-pull.sh\n+++ b/t/t5520-pull.sh\n@@ -416,6 +416,15 @@ test_expect_success \"pull --rebase warns on --verify-signatures\" '\n \ttest_i18ngrep \"ignoring --verify-signatures for rebase\" err\n '\n \n+test_expect_success \"pull --rebase warns on pull.verifySignatures=true\" '\n+\ttest_config pull.verifySignatures true &&\n+\tgit reset --hard before-rebase &&\n+\tgit pull --rebase . copy 2>err &&\n+\ttest \"$(git rev-parse HEAD^)\" = \"$(git rev-parse copy)\" &&\n+\ttest new = \"$(git show HEAD:file2)\" &&\n+\ttest_i18ngrep \"ignoring --verify-signatures for rebase\" err\n+'\n+\n test_expect_success \"pull --rebase does not warn on --no-verify-signatures\" '\n \tgit reset --hard before-rebase &&\n \tgit pull --rebase --no-verify-signatures . copy 2>err &&\n@@ -424,6 +433,15 @@ test_expect_success \"pull --rebase does not warn on --no-verify-signatures\" '\n \ttest_i18ngrep ! \"verify-signatures\" err\n '\n \n+test_expect_success \"pull --rebase does not warn on pull.verifySignatures=false\" '\n+\ttest_config pull.verifySignatures false &&\n+\tgit reset --hard before-rebase &&\n+\tgit pull --rebase . copy 2>err &&\n+\ttest \"$(git rev-parse HEAD^)\" = \"$(git rev-parse copy)\" &&\n+\ttest new = \"$(git show HEAD:file2)\" &&\n+\ttest_i18ngrep ! \"verify-signatures\" err\n+'\n+\n # add a feature branch, keep-merge, that is merged into master, so the\n # test can try preserving the merge commit (or not) with various\n # --rebase flags/pull.rebase settings.\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nindex 700247910..d1e8263d9 100755\n--- a/t/t5573-pull-verify-signatures.sh\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -47,22 +47,54 @@ test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n \ttest_i18ngrep \"does not have a GPG signature\" pullerror\n '\n \n+test_expect_success GPG 'pull unsigned commit with pull.verifySignatures=true' '\n+\ttest_config pull.verifySignatures true &&\n+\ttest_must_fail git pull --ff-only unsigned 2>pullerror &&\n+\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n+'\n+\n test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n \ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" pullerror\n '\n \n+test_expect_success GPG 'pull commit with bad signature with pull.verifySignatures=true' '\n+\ttest_config pull.verifySignatures true &&\n+\ttest_must_fail git pull --ff-only bad 2>pullerror &&\n+\ttest_i18ngrep \"has a bad GPG signature\" pullerror\n+'\n+\n test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n \ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n '\n \n+test_expect_success GPG 'pull commit with untrusted signature with pull.verifySignatures=true' '\n+\ttest_config pull.verifySignatures true &&\n+\ttest_must_fail git pull --ff-only untrusted 2>pullerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with untrusted signature with pull.verifySignatures=true and merge.verifySignatures=false' '\n+\ttest_config merge.verifySignatures false &&\n+\ttest_config pull.verifySignatures true &&\n+\ttest_must_fail git pull --ff-only untrusted 2>pullerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n+'\n+\n test_expect_success GPG 'pull signed commit with --verify-signatures' '\n \tgit pull --verify-signatures signed >pulloutput &&\n \ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n \tgit checkout initial\n '\n \n+test_expect_success GPG 'pull signed commit with pull.verifySignatures=true' '\n+\ttest_config pull.verifySignatures true &&\n+\tgit pull signed >pulloutput &&\n+\ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n+\tgit checkout initial\n+'\n+\n test_expect_success GPG 'pull commit with bad signature without verification' '\n \tgit pull --ff-only bad 2>pullerror &&\n \tgit checkout initial\n-- \n2.11.0\n\n"},{"id":"334532","messageId":"20171209090530.6747-1-hji@dyntopia.com","threadId":"47415","inReplyTo":null,"subject":"[PATCH 1/3] merge: add config option for verifySignatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-09T09:05:28Z","receivedAt":"2017-12-09T09:06:21Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"Verify the signature of the tip commit when `merge.verifySignatures` is\ntrue.  This can be overridden with `--no-verify-signatures`.\n\nSigned-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n---\n Documentation/merge-config.txt     |  7 +++++++\n builtin/merge.c                    |  2 ++\n t/t7612-merge-verify-signatures.sh | 43 ++++++++++++++++++++++++++++++++++++--\n 3 files changed, 50 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/merge-config.txt b/Documentation/merge-config.txt\nindex df3ea3779..76571cd3b 100644\n--- a/Documentation/merge-config.txt\n+++ b/Documentation/merge-config.txt\n@@ -26,6 +26,13 @@ merge.ff::\n \tallowed (equivalent to giving the `--ff-only` option from the\n \tcommand line).\n \n+merge.verifySignatures::\n+\tVerify that the tip commit of the side branch being merged is\n+\tsigned with a valid key, i.e. a key that has a valid uid: in the\n+\tdefault trust model, this means the signing key has been signed\n+\tby a trusted key. If the tip commit of the side branch is not\n+\tsigned with a valid key, the merge is aborted.\n+\n include::fmt-merge-msg-config.txt[]\n \n merge.renameLimit::\ndiff --git a/builtin/merge.c b/builtin/merge.c\nindex 612dd7bfb..30264cfd7 100644\n--- a/builtin/merge.c\n+++ b/builtin/merge.c\n@@ -567,6 +567,8 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n \n \tif (!strcmp(k, \"merge.diffstat\") || !strcmp(k, \"merge.stat\"))\n \t\tshow_diffstat = git_config_bool(k, v);\n+\telse if (!strcmp(k, \"merge.verifysignatures\"))\n+\t\tverify_signatures = git_config_bool(k, v);\n \telse if (!strcmp(k, \"pull.twohead\"))\n \t\treturn git_config_string(&pull_twohead, k, v);\n \telse if (!strcmp(k, \"pull.octopus\"))\ndiff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh\nindex 8ae69a61c..f1a74a683 100755\n--- a/t/t7612-merge-verify-signatures.sh\n+++ b/t/t7612-merge-verify-signatures.sh\n@@ -39,23 +39,62 @@ test_expect_success GPG 'merge unsigned commit with verification' '\n \ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only side-unsigned 2>mergeerror &&\n+\ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge commit with bad signature with verification' '\n \ttest_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&\n+\ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge commit with untrusted signature with verification' '\n \ttest_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only side-untrusted 2>mergeerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge signed commit with verification' '\n \tgit merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&\n-\ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n+\ttest_i18ngrep \"has a good GPG signature\" mergeoutput &&\n+\tgit checkout initial\n+'\n+\n+test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\tgit merge --verbose --ff-only side-signed >mergeoutput &&\n+\ttest_i18ngrep \"has a good GPG signature\" mergeoutput &&\n+\tgit checkout initial\n '\n \n test_expect_success GPG 'merge commit with bad signature without verification' '\n-\tgit merge $(cat forged.commit)\n+\tgit merge $(cat forged.commit) &&\n+\tgit checkout initial\n+'\n+\n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '\n+\ttest_config merge.verifySignatures false &&\n+\tgit merge $(cat forged.commit) &&\n+\tgit checkout initial\n+'\n+\n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '\n+\ttest_config merge.verifySignatures true &&\n+\tgit merge --no-verify-signatures $(cat forged.commit) &&\n+\tgit checkout initial\n '\n \n test_done\n-- \n2.11.0\n\n"},{"id":"334534","messageId":"20171209120537.GA6006@alpha.vpn.ikke.info","threadId":"47415","inReplyTo":"20171209090530.6747-1-hji@dyntopia.com","subject":"Re: [PATCH 1/3] merge: add config option for verifySignatures","fromName":"Kevin Daudt","fromEmail":"me@ikke.info","sentAt":"2017-12-09T12:05:37Z","receivedAt":"2017-12-09T12:05:45Z","isPatch":true,"sender":{"key":"me@ikke.info","avatar":"https://avatars.githubusercontent.com/u/135698?v=4"},"body":"Hello Hans Jerry,\n\nThank you for your contribution. I have soem remarks below.\n\nOn Sat, Dec 09, 2017 at 09:05:28AM +0000, Hans Jerry Illikainen wrote:\n> Verify the signature of the tip commit when `merge.verifySignatures` is\n> true.  This can be overridden with `--no-verify-signatures`.\n> \n> Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n\nI miss the motivation in the commit message. I imagine something like:\n\n    git merge --verify-signatures can be used to verify that the tip\n    commit of the branch being merged in is properly signed, but it's\n    cumbersome to have to specify that every time.\n    \n    Add a configuration option that enables this behaviour by default,\n    which can be overridden by --no-verify-signatures.\n\n\n> ---\n>  Documentation/merge-config.txt     |  7 +++++++\n>  builtin/merge.c                    |  2 ++\n>  t/t7612-merge-verify-signatures.sh | 43 ++++++++++++++++++++++++++++++++++++--\n>  3 files changed, 50 insertions(+), 2 deletions(-)\n> \n> diff --git a/Documentation/merge-config.txt b/Documentation/merge-config.txt\n> index df3ea3779..76571cd3b 100644\n> --- a/Documentation/merge-config.txt\n> +++ b/Documentation/merge-config.txt\n> @@ -26,6 +26,13 @@ merge.ff::\n>  \tallowed (equivalent to giving the `--ff-only` option from the\n>  \tcommand line).\n>  \n> +merge.verifySignatures::\n> +\tVerify that the tip commit of the side branch being merged is\n> +\tsigned with a valid key, i.e. a key that has a valid uid: in the\n> +\tdefault trust model, this means the signing key has been signed\n> +\tby a trusted key. If the tip commit of the side branch is not\n> +\tsigned with a valid key, the merge is aborted.\n> +\n\nThis is a verbatim copy of the explenation of --verify-signatures. Would\nit be an idea to refer to the explenation of merge --verify-signatures?\n\n>  include::fmt-merge-msg-config.txt[]\n>  \n>  merge.renameLimit::\n> diff --git a/builtin/merge.c b/builtin/merge.c\n> index 612dd7bfb..30264cfd7 100644\n> --- a/builtin/merge.c\n> +++ b/builtin/merge.c\n> @@ -567,6 +567,8 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n>  \n>  \tif (!strcmp(k, \"merge.diffstat\") || !strcmp(k, \"merge.stat\"))\n>  \t\tshow_diffstat = git_config_bool(k, v);\n> +\telse if (!strcmp(k, \"merge.verifysignatures\"))\n> +\t\tverify_signatures = git_config_bool(k, v);\n>  \telse if (!strcmp(k, \"pull.twohead\"))\n>  \t\treturn git_config_string(&pull_twohead, k, v);\n>  \telse if (!strcmp(k, \"pull.octopus\"))\n> diff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh\n> index 8ae69a61c..f1a74a683 100755\n> --- a/t/t7612-merge-verify-signatures.sh\n> +++ b/t/t7612-merge-verify-signatures.sh\n> @@ -39,23 +39,62 @@ test_expect_success GPG 'merge unsigned commit with verification' '\n>  \ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n>  '\n>  \n> +test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '\n> +\ttest_config merge.verifySignatures true &&\n> +\ttest_must_fail git merge --ff-only side-unsigned 2>mergeerror &&\n> +\ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n> +'\n> +\n>  test_expect_success GPG 'merge commit with bad signature with verification' '\n>  \ttest_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&\n>  \ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n>  '\n>  \n> +test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '\n> +\ttest_config merge.verifySignatures true &&\n> +\ttest_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&\n> +\ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n> +'\n> +\n>  test_expect_success GPG 'merge commit with untrusted signature with verification' '\n>  \ttest_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&\n>  \ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n>  '\n>  \n> +test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '\n> +\ttest_config merge.verifySignatures true &&\n> +\ttest_must_fail git merge --ff-only side-untrusted 2>mergeerror &&\n> +\ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n> +'\n> +\n>  test_expect_success GPG 'merge signed commit with verification' '\n>  \tgit merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&\n> -\ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n> +\ttest_i18ngrep \"has a good GPG signature\" mergeoutput &&\n> +\tgit checkout initial\n\nThis looks like a clean up step. If so, it's better to add\n`test_when_finished 'git checkout initial'` at the beginning to clearly\nmark it as a clean up step and make sure it's run even when the test\nfails. Same counts for the other occurances.\n\n> +'\n> +\n> +test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '\n> +\ttest_config merge.verifySignatures true &&\n> +\tgit merge --verbose --ff-only side-signed >mergeoutput &&\n> +\ttest_i18ngrep \"has a good GPG signature\" mergeoutput &&\n> +\tgit checkout initial\n>  '\n>  \n>  test_expect_success GPG 'merge commit with bad signature without verification' '\n> -\tgit merge $(cat forged.commit)\n> +\tgit merge $(cat forged.commit) &&\n> +\tgit checkout initial\n> +'\n> +\n> +test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '\n> +\ttest_config merge.verifySignatures false &&\n> +\tgit merge $(cat forged.commit) &&\n> +\tgit checkout initial\n> +'\n> +\n> +test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '\n> +\ttest_config merge.verifySignatures true &&\n> +\tgit merge --no-verify-signatures $(cat forged.commit) &&\n> +\tgit checkout initial\n>  '\n>  \n>  test_done\n\nKevin.\n"},{"id":"334535","messageId":"20171209120614.GB6006@alpha.vpn.ikke.info","threadId":"47415","inReplyTo":"20171209090530.6747-2-hji@dyntopia.com","subject":"Re: [PATCH 2/3] t: add tests for pull --verify-signatures","fromName":"Kevin Daudt","fromEmail":"me@ikke.info","sentAt":"2017-12-09T12:06:14Z","receivedAt":"2017-12-09T12:06:20Z","isPatch":true,"sender":{"key":"me@ikke.info","avatar":"https://avatars.githubusercontent.com/u/135698?v=4"},"body":"On Sat, Dec 09, 2017 at 09:05:29AM +0000, Hans Jerry Illikainen wrote:\n> Add tests for `pull --verify-signatures` with untrusted, bad and no\n> signatures.  Previously the only test for `--verify-signatures` was to\n> make sure that `pull --rebase --verify-signatures` result in a warning\n> (t5520-pull.sh).\n\nNice!\n\nSame thing regarding the `git checkout initial` commands counts\nhere too.\n\n> \n> Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n> ---\n>  t/t5573-pull-verify-signatures.sh | 78 +++++++++++++++++++++++++++++++++++++++\n>  1 file changed, 78 insertions(+)\n>  create mode 100755 t/t5573-pull-verify-signatures.sh\n> \n> diff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\n> new file mode 100755\n> index 000000000..700247910\n> --- /dev/null\n> +++ b/t/t5573-pull-verify-signatures.sh\n> @@ -0,0 +1,78 @@\n> +#!/bin/sh\n> +\n> +test_description='pull signature verification tests'\n> +. ./test-lib.sh\n> +. \"$TEST_DIRECTORY/lib-gpg.sh\"\n> +\n> +test_expect_success GPG 'create repositories with signed commits' '\n> +\techo 1 >a && git add a &&\n> +\ttest_tick && git commit -m initial &&\n> +\tgit tag initial &&\n> +\n> +\tgit clone . signed &&\n> +\t(\n> +\t\tcd signed &&\n> +\t\techo 2 >b && git add b &&\n> +\t\ttest_tick && git commit -S -m \"signed\"\n> +\t) &&\n> +\n> +\tgit clone . unsigned &&\n> +\t(\n> +\t\tcd unsigned &&\n> +\t\techo 3 >c && git add c &&\n> +\t\ttest_tick && git commit -m \"unsigned\"\n> +\t) &&\n> +\n> +\tgit clone . bad &&\n> +\t(\n> +\t\tcd bad &&\n> +\t\techo 4 >d && git add d &&\n> +\t\ttest_tick && git commit -S -m \"bad\" &&\n> +\t\tgit cat-file commit HEAD >raw &&\n> +\t\tsed -e \"s/bad/forged bad/\" raw >forged &&\n> +\t\tgit hash-object -w -t commit forged >forged.commit &&\n> +\t\tgit checkout $(cat forged.commit)\n> +\t) &&\n> +\n> +\tgit clone . untrusted &&\n> +\t(\n> +\t\tcd untrusted &&\n> +\t\techo 5 >e && git add e &&\n> +\t\ttest_tick && git commit -SB7227189 -m \"untrusted\"\n> +\t)\n> +'\n> +\n> +test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n> +\ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n> +\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n> +'\n> +\n> +test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n> +\ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n> +\ttest_i18ngrep \"has a bad GPG signature\" pullerror\n> +'\n> +\n> +test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n> +\ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n> +\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n> +'\n> +\n> +test_expect_success GPG 'pull signed commit with --verify-signatures' '\n> +\tgit pull --verify-signatures signed >pulloutput &&\n> +\ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n> +\tgit checkout initial\n> +'\n> +\n> +test_expect_success GPG 'pull commit with bad signature without verification' '\n> +\tgit pull --ff-only bad 2>pullerror &&\n> +\tgit checkout initial\n> +'\n> +\n> +test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '\n> +\ttest_config merge.verifySignatures true &&\n> +\ttest_config pull.verifySignatures true &&\n> +\tgit pull --ff-only --no-verify-signatures bad 2>pullerror &&\n> +\tgit checkout initial\n> +'\n> +\n> +test_done\n> -- \n> 2.11.0\n> \n"},{"id":"334536","messageId":"20171209120623.GC6006@alpha.vpn.ikke.info","threadId":"47415","inReplyTo":"20171209090530.6747-3-hji@dyntopia.com","subject":"Re: [PATCH 3/3] pull: add config option for verifySignatures","fromName":"Kevin Daudt","fromEmail":"me@ikke.info","sentAt":"2017-12-09T12:06:23Z","receivedAt":"2017-12-09T12:06:30Z","isPatch":true,"sender":{"key":"me@ikke.info","avatar":"https://avatars.githubusercontent.com/u/135698?v=4"},"body":"On Sat, Dec 09, 2017 at 09:05:30AM +0000, Hans Jerry Illikainen wrote:\n> Verify the signature of the tip commit when `pull.verifySignatures` is\n> true.  This option overrides `merge.verifySignatures` on pull, and can\n> be disabled with the option `--no-verify-signatures`.\n\nIs there a reason why git pull would need a different behaviour from git\nmerge? Pull itself is just a convenience command for fetch +\nmerge/rebase.\n\nOne precedent for having a separate configuration option for pull\nhowever is 'pull.ff', so there might be a usecase for it.\n\nI guess your commit message could use a motivation on why you want to\nset this differently from 'merge.verifySignature'.\n\n> \n> Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n> ---\n>  Documentation/config.txt          |  8 ++++++++\n>  builtin/pull.c                    | 25 +++++++++++++++++++++++++\n>  t/t5520-pull.sh                   | 18 ++++++++++++++++++\n>  t/t5573-pull-verify-signatures.sh | 32 ++++++++++++++++++++++++++++++++\n>  4 files changed, 83 insertions(+)\n> \n> diff --git a/Documentation/config.txt b/Documentation/config.txt\n> index c1598ee70..0cd2bc597 100644\n> --- a/Documentation/config.txt\n> +++ b/Documentation/config.txt\n> @@ -2596,6 +2596,14 @@ pull.ff::\n>  \tallowed (equivalent to giving the `--ff-only` option from the\n>  \tcommand line). This setting overrides `merge.ff` when pulling.\n>  \n> +pull.verifySignatures::\n> +\tVerify that the tip commit of the side branch being merged is\n> +\tsigned with a valid key, i.e. a key that has a valid uid: in the\n> +\tdefault trust model, this means the signing key has been signed\n> +\tby a trusted key. If the tip commit of the side branch is not\n> +\tsigned with a valid key, the merge is aborted. This setting\n> +\toverrides `merge.verifySignatures` when pulling.\n> +\n>  pull.rebase::\n>  \tWhen true, rebase branches on top of the fetched branch, instead\n>  \tof merging the default branch from the default remote when \"git\n> diff --git a/builtin/pull.c b/builtin/pull.c\n> index 166b777ed..791365915 100644\n> --- a/builtin/pull.c\n> +++ b/builtin/pull.c\n> @@ -300,6 +300,28 @@ static const char *config_get_ff(void)\n>  }\n>  \n>  /**\n> + * If pull.verifySignatures is unset, returns NULL. If pull.verifySignatures is\n> + * \"true\", returns \"--verify-signatures\". If pull.verifySignatures is \"false\",\n> + * returns \"--no-verify-signatures\". Otherwise, die with an error.\n> + */\n> +static const char *config_get_verify_signatures(void)\n> +{\n> +\tconst char *value;\n> +\n> +\tif (git_config_get_value(\"pull.verifysignatures\", &value))\n> +\t\treturn NULL;\n> +\n> +\tswitch (git_parse_maybe_bool(value)) {\n> +\tcase 0:\n> +\t\treturn \"--no-verify-signatures\";\n> +\tcase 1:\n> +\t\treturn \"--verify-signatures\";\n> +\tdefault:\n> +\t\tdie(_(\"Invalid value for pull.verifysignatures: %s\"), value);\n> +\t}\n> +}\n> +\n> +/**\n>   * Returns the default configured value for --rebase. It first looks for the\n>   * value of \"branch.$curr_branch.rebase\", where $curr_branch is the current\n>   * branch, and if HEAD is detached or the configuration key does not exist,\n> @@ -849,6 +871,9 @@ int cmd_pull(int argc, const char **argv, const char *prefix)\n>  \tif (!opt_ff)\n>  \t\topt_ff = xstrdup_or_null(config_get_ff());\n>  \n> +\tif (!opt_verify_signatures)\n> +\t\topt_verify_signatures = xstrdup_or_null(config_get_verify_signatures());\n> +\n>  \tif (opt_rebase < 0)\n>  \t\topt_rebase = config_get_rebase();\n>  \n> diff --git a/t/t5520-pull.sh b/t/t5520-pull.sh\n> index 59c4b778d..cdf1fd213 100755\n> --- a/t/t5520-pull.sh\n> +++ b/t/t5520-pull.sh\n> @@ -416,6 +416,15 @@ test_expect_success \"pull --rebase warns on --verify-signatures\" '\n>  \ttest_i18ngrep \"ignoring --verify-signatures for rebase\" err\n>  '\n>  \n> +test_expect_success \"pull --rebase warns on pull.verifySignatures=true\" '\n> +\ttest_config pull.verifySignatures true &&\n> +\tgit reset --hard before-rebase &&\n> +\tgit pull --rebase . copy 2>err &&\n> +\ttest \"$(git rev-parse HEAD^)\" = \"$(git rev-parse copy)\" &&\n> +\ttest new = \"$(git show HEAD:file2)\" &&\n> +\ttest_i18ngrep \"ignoring --verify-signatures for rebase\" err\n> +'\n> +\n>  test_expect_success \"pull --rebase does not warn on --no-verify-signatures\" '\n>  \tgit reset --hard before-rebase &&\n>  \tgit pull --rebase --no-verify-signatures . copy 2>err &&\n> @@ -424,6 +433,15 @@ test_expect_success \"pull --rebase does not warn on --no-verify-signatures\" '\n>  \ttest_i18ngrep ! \"verify-signatures\" err\n>  '\n>  \n> +test_expect_success \"pull --rebase does not warn on pull.verifySignatures=false\" '\n> +\ttest_config pull.verifySignatures false &&\n> +\tgit reset --hard before-rebase &&\n> +\tgit pull --rebase . copy 2>err &&\n> +\ttest \"$(git rev-parse HEAD^)\" = \"$(git rev-parse copy)\" &&\n> +\ttest new = \"$(git show HEAD:file2)\" &&\n> +\ttest_i18ngrep ! \"verify-signatures\" err\n> +'\n> +\n>  # add a feature branch, keep-merge, that is merged into master, so the\n>  # test can try preserving the merge commit (or not) with various\n>  # --rebase flags/pull.rebase settings.\n> diff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\n> index 700247910..d1e8263d9 100755\n> --- a/t/t5573-pull-verify-signatures.sh\n> +++ b/t/t5573-pull-verify-signatures.sh\n> @@ -47,22 +47,54 @@ test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n>  \ttest_i18ngrep \"does not have a GPG signature\" pullerror\n>  '\n>  \n> +test_expect_success GPG 'pull unsigned commit with pull.verifySignatures=true' '\n> +\ttest_config pull.verifySignatures true &&\n> +\ttest_must_fail git pull --ff-only unsigned 2>pullerror &&\n> +\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n> +'\n> +\n>  test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n>  \ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n>  \ttest_i18ngrep \"has a bad GPG signature\" pullerror\n>  '\n>  \n> +test_expect_success GPG 'pull commit with bad signature with pull.verifySignatures=true' '\n> +\ttest_config pull.verifySignatures true &&\n> +\ttest_must_fail git pull --ff-only bad 2>pullerror &&\n> +\ttest_i18ngrep \"has a bad GPG signature\" pullerror\n> +'\n> +\n>  test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n>  \ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n>  \ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n>  '\n>  \n> +test_expect_success GPG 'pull commit with untrusted signature with pull.verifySignatures=true' '\n> +\ttest_config pull.verifySignatures true &&\n> +\ttest_must_fail git pull --ff-only untrusted 2>pullerror &&\n> +\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n> +'\n> +\n> +test_expect_success GPG 'pull commit with untrusted signature with pull.verifySignatures=true and merge.verifySignatures=false' '\n> +\ttest_config merge.verifySignatures false &&\n> +\ttest_config pull.verifySignatures true &&\n> +\ttest_must_fail git pull --ff-only untrusted 2>pullerror &&\n> +\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n> +'\n> +\n>  test_expect_success GPG 'pull signed commit with --verify-signatures' '\n>  \tgit pull --verify-signatures signed >pulloutput &&\n>  \ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n>  \tgit checkout initial\n>  '\n>  \n> +test_expect_success GPG 'pull signed commit with pull.verifySignatures=true' '\n> +\ttest_config pull.verifySignatures true &&\n> +\tgit pull signed >pulloutput &&\n> +\ttest_i18ngrep \"has a good GPG signature\" pulloutput &&\n> +\tgit checkout initial\n> +'\n> +\n>  test_expect_success GPG 'pull commit with bad signature without verification' '\n>  \tgit pull --ff-only bad 2>pullerror &&\n>  \tgit checkout initial\n> -- \n> 2.11.0\n> \n"},{"id":"334557","messageId":"20171210064840.GA8087@darpa.mil","threadId":"47415","inReplyTo":"20171209120623.GC6006@alpha.vpn.ikke.info","subject":"Re: [PATCH 3/3] pull: add config option for verifySignatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-10T06:48:40Z","receivedAt":"2017-12-10T06:53:41Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"On Sat, Dec 09, 2017 at 01:06:23PM +0100, Kevin Daudt wrote:\n> On Sat, Dec 09, 2017 at 09:05:30AM +0000, Hans Jerry Illikainen wrote:\n> > Verify the signature of the tip commit when `pull.verifySignatures` is\n> > true.  This option overrides `merge.verifySignatures` on pull, and can\n> > be disabled with the option `--no-verify-signatures`.\n> \n> Is there a reason why git pull would need a different behaviour from git\n> merge? Pull itself is just a convenience command for fetch +\n> merge/rebase.\n> \n> One precedent for having a separate configuration option for pull\n> however is 'pull.ff', so there might be a usecase for it.\n> \n> I guess your commit message could use a motivation on why you want to\n> set this differently from 'merge.verifySignature'.\n\nThanks for the review!  I wasn't sure whether pull.verifySignatures made\nsense -- I included it to be consistent with pull.ff/merge.ff, but it's\nscrapped in v2.\n\n-- \nhji\n"},{"id":"334558","messageId":"20171210065358.8156-2-hji@dyntopia.com","threadId":"47415","inReplyTo":"20171210065358.8156-1-hji@dyntopia.com","subject":"[PATCH v2 2/2] t: add tests for pull --verify-signatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-10T06:53:58Z","receivedAt":"2017-12-10T06:53:44Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"Add tests for pull --verify-signatures with untrusted, bad and no\nsignatures.  Previously the only test for --verify-signatures was to\nmake sure that pull --rebase --verify-signatures result in a warning\n(t5520-pull.sh).\n\nSigned-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n---\n t/t5573-pull-verify-signatures.sh | 78 +++++++++++++++++++++++++++++++++++++++\n 1 file changed, 78 insertions(+)\n create mode 100755 t/t5573-pull-verify-signatures.sh\n\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nnew file mode 100755\nindex 000000000..8ae331f40\n--- /dev/null\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -0,0 +1,78 @@\n+#!/bin/sh\n+\n+test_description='pull signature verification tests'\n+. ./test-lib.sh\n+. \"$TEST_DIRECTORY/lib-gpg.sh\"\n+\n+test_expect_success GPG 'create repositories with signed commits' '\n+\techo 1 >a && git add a &&\n+\ttest_tick && git commit -m initial &&\n+\tgit tag initial &&\n+\n+\tgit clone . signed &&\n+\t(\n+\t\tcd signed &&\n+\t\techo 2 >b && git add b &&\n+\t\ttest_tick && git commit -S -m \"signed\"\n+\t) &&\n+\n+\tgit clone . unsigned &&\n+\t(\n+\t\tcd unsigned &&\n+\t\techo 3 >c && git add c &&\n+\t\ttest_tick && git commit -m \"unsigned\"\n+\t) &&\n+\n+\tgit clone . bad &&\n+\t(\n+\t\tcd bad &&\n+\t\techo 4 >d && git add d &&\n+\t\ttest_tick && git commit -S -m \"bad\" &&\n+\t\tgit cat-file commit HEAD >raw &&\n+\t\tsed -e \"s/bad/forged bad/\" raw >forged &&\n+\t\tgit hash-object -w -t commit forged >forged.commit &&\n+\t\tgit checkout $(cat forged.commit)\n+\t) &&\n+\n+\tgit clone . untrusted &&\n+\t(\n+\t\tcd untrusted &&\n+\t\techo 5 >e && git add e &&\n+\t\ttest_tick && git commit -SB7227189 -m \"untrusted\"\n+\t)\n+'\n+\n+test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n+\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n+\ttest_i18ngrep \"has a bad GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n+\ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n+'\n+\n+test_expect_success GPG 'pull signed commit with --verify-signatures' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\tgit pull --verify-signatures signed >pulloutput &&\n+\ttest_i18ngrep \"has a good GPG signature\" pulloutput\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature without verification' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\tgit pull --ff-only bad 2>pullerror\n+'\n+\n+test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\ttest_config merge.verifySignatures true &&\n+\ttest_config pull.verifySignatures true &&\n+\tgit pull --ff-only --no-verify-signatures bad 2>pullerror\n+'\n+\n+test_done\n-- \n2.15.1.356.g13e4cf275\n\n"},{"id":"334559","messageId":"20171210065358.8156-1-hji@dyntopia.com","threadId":"47415","inReplyTo":"20171209090530.6747-1-hji@dyntopia.com","subject":"[PATCH v2 1/2] merge: add config option for verifySignatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-10T06:53:57Z","receivedAt":"2017-12-10T06:53:52Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"git merge --verify-signatures can be used to verify that the tip commit\nof the branch being merged in is properly signed, but it's cumbersome to\nhave to specify that every time.\n\nAdd a configuration option that enables this behaviour by default, which\ncan be overridden by --no-verify-signatures.\n\nSigned-off-by: Hans Jerry Illikainen <hji@dyntopia.com>\n---\n Documentation/merge-config.txt     |  4 ++++\n builtin/merge.c                    |  2 ++\n t/t7612-merge-verify-signatures.sh | 39 ++++++++++++++++++++++++++++++++++++++\n 3 files changed, 45 insertions(+)\n\ndiff --git a/Documentation/merge-config.txt b/Documentation/merge-config.txt\nindex df3ea3779..12b6bbf59 100644\n--- a/Documentation/merge-config.txt\n+++ b/Documentation/merge-config.txt\n@@ -26,6 +26,10 @@ merge.ff::\n \tallowed (equivalent to giving the `--ff-only` option from the\n \tcommand line).\n \n+merge.verifySignatures::\n+\tIf true, this is equivalent to the --verify-signatures command\n+\tline option. See linkgit:git-merge[1] for details.\n+\n include::fmt-merge-msg-config.txt[]\n \n merge.renameLimit::\ndiff --git a/builtin/merge.c b/builtin/merge.c\nindex 612dd7bfb..30264cfd7 100644\n--- a/builtin/merge.c\n+++ b/builtin/merge.c\n@@ -567,6 +567,8 @@ static int git_merge_config(const char *k, const char *v, void *cb)\n \n \tif (!strcmp(k, \"merge.diffstat\") || !strcmp(k, \"merge.stat\"))\n \t\tshow_diffstat = git_config_bool(k, v);\n+\telse if (!strcmp(k, \"merge.verifysignatures\"))\n+\t\tverify_signatures = git_config_bool(k, v);\n \telse if (!strcmp(k, \"pull.twohead\"))\n \t\treturn git_config_string(&pull_twohead, k, v);\n \telse if (!strcmp(k, \"pull.octopus\"))\ndiff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh\nindex 8ae69a61c..2344995a1 100755\n--- a/t/t7612-merge-verify-signatures.sh\n+++ b/t/t7612-merge-verify-signatures.sh\n@@ -39,23 +39,62 @@ test_expect_success GPG 'merge unsigned commit with verification' '\n \ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only side-unsigned 2>mergeerror &&\n+\ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge commit with bad signature with verification' '\n \ttest_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&\n+\ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge commit with untrusted signature with verification' '\n \ttest_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n '\n \n+test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '\n+\ttest_config merge.verifySignatures true &&\n+\ttest_must_fail git merge --ff-only side-untrusted 2>mergeerror &&\n+\ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n+'\n+\n test_expect_success GPG 'merge signed commit with verification' '\n+\ttest_when_finished \"git checkout initial\" &&\n \tgit merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&\n \ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n '\n \n+test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\ttest_config merge.verifySignatures true &&\n+\tgit merge --verbose --ff-only side-signed >mergeoutput &&\n+\ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n+'\n+\n test_expect_success GPG 'merge commit with bad signature without verification' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\tgit merge $(cat forged.commit)\n+'\n+\n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\ttest_config merge.verifySignatures false &&\n \tgit merge $(cat forged.commit)\n '\n \n+test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '\n+\ttest_when_finished \"git checkout initial\" &&\n+\ttest_config merge.verifySignatures true &&\n+\tgit merge --no-verify-signatures $(cat forged.commit)\n+'\n+\n test_done\n-- \n2.15.1.356.g13e4cf275\n\n"},{"id":"334690","messageId":"xmqqh8sv3hde.fsf@gitster.mtv.corp.google.com","threadId":"47415","inReplyTo":"20171209120537.GA6006@alpha.vpn.ikke.info","subject":"Re: [PATCH 1/3] merge: add config option for verifySignatures","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-12-12T18:56:13Z","receivedAt":"2017-12-12T18:56:20Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Kevin Daudt <me@ikke.info> writes:\n\n> Hello Hans Jerry,\n>\n> Thank you for your contribution. I have soem remarks below.\n> ...\n\nThanks for a detailed review.  I agree with all the things you\npointed out, and I see they are reflected in v2 of the series.\n\nVery much appreciated; thanks, both.\n"},{"id":"334692","messageId":"xmqqbmj33h0s.fsf@gitster.mtv.corp.google.com","threadId":"47415","inReplyTo":"20171210065358.8156-2-hji@dyntopia.com","subject":"Re: [PATCH v2 2/2] t: add tests for pull --verify-signatures","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-12-12T19:03:47Z","receivedAt":"2017-12-12T19:03:54Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Hans Jerry Illikainen <hji@dyntopia.com> writes:\n\n> +test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n> +\ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n> +\ttest_i18ngrep \"does not have a GPG signature\" pullerror\n> +'\n\nNote that this is without \"when-finished\"; if 'git pull' got broken\nand does not fail as expected, the next test will start from a state\nthat it is not expecting.  Same for the ones that run 'git pull'\nunder test_must_fail.\n\nInterestingly, the tests that do expect 'git pull' to succeed\nprotect themselves with \"when-finished\" mechanism correctly [*1*],\nlike so:\n\n> +test_expect_success GPG 'pull signed commit with --verify-signatures' '\n> +\ttest_when_finished \"git checkout initial\" &&\n> +\tgit pull --verify-signatures signed >pulloutput &&\n> +\ttest_i18ngrep \"has a good GPG signature\" pulloutput\n> +'\n> +\n\nOther than that, looked nicely done.  Thanks.\n\n\n[Footnote]\n\n*1* I am guessing that the branches that are being pulled in tests\n    are designed in such a way to never produce merge conflicts, and\n    failures are possible only due to signature verification.  If\n    that were not the case, \"when-finished\" would want to do a hard\n    reset before checking out the initial to go back to a known\n    state.\n"},{"id":"334908","messageId":"xmqqmv2jpyb6.fsf_-_@gitster.mtv.corp.google.com","threadId":"47415","inReplyTo":"xmqqbmj33h0s.fsf@gitster.mtv.corp.google.com","subject":"Re* [PATCH v2 2/2] t: add tests for pull --verify-signatures","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-12-15T19:48:29Z","receivedAt":"2017-12-15T19:48:37Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> Interestingly, the tests that do expect 'git pull' to succeed\n> protect themselves with \"when-finished\" mechanism correctly [*1*],\n> like so:\n>\n>> +test_expect_success GPG 'pull signed commit with --verify-signatures' '\n>> +\ttest_when_finished \"git checkout initial\" &&\n>> +\tgit pull --verify-signatures signed >pulloutput &&\n>> +\ttest_i18ngrep \"has a good GPG signature\" pulloutput\n>> +'\n>> +\n>\n> Other than that, looked nicely done.  Thanks.\n\nHere is what I would propose as a follow-up polishing.\n\n-- >8 --\nSubject: [PATCH 3/2] t5573: clean up after unexpected success of 'pull', too\n\nThe previous step added test_when_finished to tests that run 'git\npull' with expectation of success, so that the test after them can\nstart from a known state even when their 'git pull' invocation\nunexpectedly fails.  However, tests that run 'git pull' expecting\nit not to succeed forgot to protect later tests the same way---if\nthey unexpectedly succeed, the test after them would start from an\nunexpected state.\n\nReset and checkout the initial commit after all these tests, whether\nthey expect their 'git pull' invocations to succeed or fail.\n\nSigned-off-by: Junio C Hamano <gitster@pobox.com>\n---\n t/t5573-pull-verify-signatures.sh | 9 ++++++---\n 1 file changed, 6 insertions(+), 3 deletions(-)\n\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nindex 8ae331f40e..9594e891f4 100755\n--- a/t/t5573-pull-verify-signatures.sh\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -43,33 +43,36 @@ test_expect_success GPG 'create repositories with signed commits' '\n '\n \n test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n \ttest_i18ngrep \"does not have a GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull signed commit with --verify-signatures' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit pull --verify-signatures signed >pulloutput &&\n \ttest_i18ngrep \"has a good GPG signature\" pulloutput\n '\n \n test_expect_success GPG 'pull commit with bad signature without verification' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit pull --ff-only bad 2>pullerror\n '\n \n test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \ttest_config pull.verifySignatures true &&\n \tgit pull --ff-only --no-verify-signatures bad 2>pullerror\n-- \n2.15.1-558-ged696bbdd8\n\n"},{"id":"334921","messageId":"20171216093440.GB5617@darpa.mil","threadId":"47415","inReplyTo":"xmqqmv2jpyb6.fsf_-_@gitster.mtv.corp.google.com","subject":"Re: Re* [PATCH v2 2/2] t: add tests for pull --verify-signatures","fromName":"Hans Jerry Illikainen","fromEmail":"hji@dyntopia.com","sentAt":"2017-12-16T09:34:40Z","receivedAt":"2017-12-16T09:35:03Z","isPatch":true,"sender":{"key":"hji@dyntopia.com","avatar":"https://avatars.githubusercontent.com/u/8175517?v=4"},"body":"On Fri, Dec 15, 2017 at 11:48:29AM -0800, Junio C Hamano wrote:\n> Here is what I would propose as a follow-up polishing.\n> \n> -- >8 --\n> Subject: [PATCH 3/2] t5573: clean up after unexpected success of 'pull', too\n> \n> The previous step added test_when_finished to tests that run 'git\n> pull' with expectation of success, so that the test after them can\n> start from a known state even when their 'git pull' invocation\n> unexpectedly fails.  However, tests that run 'git pull' expecting\n> it not to succeed forgot to protect later tests the same way---if\n> they unexpectedly succeed, the test after them would start from an\n> unexpected state.\n> \n> Reset and checkout the initial commit after all these tests, whether\n> they expect their 'git pull' invocations to succeed or fail.\n> \n> Signed-off-by: Junio C Hamano <gitster@pobox.com>\n> ---\n>  t/t5573-pull-verify-signatures.sh | 9 ++++++---\n>  1 file changed, 6 insertions(+), 3 deletions(-)\n\nThanks!  t7612-merge-verify-signatures.sh also lacks cleanup for\ntest_must_fail brokenness.  Would you prefer test_when_finished to be\nincluded in the two patches as a v3?\n\n-- \nhji\n"},{"id":"334947","messageId":"xmqqzi6hop14.fsf@gitster.mtv.corp.google.com","threadId":"47415","inReplyTo":"20171216093440.GB5617@darpa.mil","subject":"Re: Re* [PATCH v2 2/2] t: add tests for pull --verify-signatures","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-12-17T06:18:47Z","receivedAt":"2017-12-17T06:18:54Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Hans Jerry Illikainen <hji@dyntopia.com> writes:\n\n> Thanks!  t7612-merge-verify-signatures.sh also lacks cleanup for\n> test_must_fail brokenness.  Would you prefer test_when_finished to be\n> included in the two patches as a v3?\n\nNo, I do not want a v3 as these are already in 'next'.  Just like my\nfollow-up clean-up you are responding to is [PATCH 3/2], if you want\nfurther work on it, the preferred method from now on is to send in\nincremental updates on top of what has already been accepted.\n\n\nThanks.\n\n"},{"id":"335042","messageId":"xmqqfu86v3e3.fsf_-_@gitster.mtv.corp.google.com","threadId":"47415","inReplyTo":"xmqqmv2jpyb6.fsf_-_@gitster.mtv.corp.google.com","subject":"[PATCH v2 3/2] t5573, t7612: clean up after unexpected success of 'pull' and 'merge'","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-12-19T21:01:08Z","receivedAt":"2017-12-19T21:01:28Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"The previous steps added test_when_finished to tests that run 'git\npull' or 'git merge' with expectation of success, so that the test\nafter them can start from a known state even when their 'git pull'\ninvocation unexpectedly fails.  However, tests that run 'git pull'\nor 'git merge' expecting it not to succeed forgot to protect later\ntests the same way---if they unexpectedly succeed, the test after\nthem would start from an unexpected state.\n\nReset and checkout the initial commit after all these tests, whether\nthey expect their invocations to succeed or fail.\n\nSigned-off-by: Junio C Hamano <gitster@pobox.com>\n---\n\n * Let's do this and move the whole thing forward.\n\n t/t5573-pull-verify-signatures.sh  |  9 ++++++---\n t/t7612-merge-verify-signatures.sh | 16 +++++++++++-----\n 2 files changed, 17 insertions(+), 8 deletions(-)\n\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nindex 8ae331f40e..9594e891f4 100755\n--- a/t/t5573-pull-verify-signatures.sh\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -43,33 +43,36 @@ test_expect_success GPG 'create repositories with signed commits' '\n '\n \n test_expect_success GPG 'pull unsigned commit with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&\n \ttest_i18ngrep \"does not have a GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" pullerror\n '\n \n test_expect_success GPG 'pull signed commit with --verify-signatures' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit pull --verify-signatures signed >pulloutput &&\n \ttest_i18ngrep \"has a good GPG signature\" pulloutput\n '\n \n test_expect_success GPG 'pull commit with bad signature without verification' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit pull --ff-only bad 2>pullerror\n '\n \n test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \ttest_config pull.verifySignatures true &&\n \tgit pull --ff-only --no-verify-signatures bad 2>pullerror\ndiff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh\nindex 2344995a11..e797c74112 100755\n--- a/t/t7612-merge-verify-signatures.sh\n+++ b/t/t7612-merge-verify-signatures.sh\n@@ -35,64 +35,70 @@ test_expect_success GPG 'create signed commits' '\n '\n \n test_expect_success GPG 'merge unsigned commit with verification' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git merge --ff-only --verify-signatures side-unsigned 2>mergeerror &&\n \ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \ttest_must_fail git merge --ff-only side-unsigned 2>mergeerror &&\n \ttest_i18ngrep \"does not have a GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge commit with bad signature with verification' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \ttest_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&\n \ttest_i18ngrep \"has a bad GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge commit with untrusted signature with verification' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \ttest_must_fail git merge --ff-only side-untrusted 2>mergeerror &&\n \ttest_i18ngrep \"has an untrusted GPG signature\" mergeerror\n '\n \n test_expect_success GPG 'merge signed commit with verification' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&\n \ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n '\n \n test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \tgit merge --verbose --ff-only side-signed >mergeoutput &&\n \ttest_i18ngrep \"has a good GPG signature\" mergeoutput\n '\n \n test_expect_success GPG 'merge commit with bad signature without verification' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \tgit merge $(cat forged.commit)\n '\n \n test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures false &&\n \tgit merge $(cat forged.commit)\n '\n \n test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '\n-\ttest_when_finished \"git checkout initial\" &&\n+\ttest_when_finished \"git reset --hard && git checkout initial\" &&\n \ttest_config merge.verifySignatures true &&\n \tgit merge --no-verify-signatures $(cat forged.commit)\n '\n-- \n2.15.1-574-g4ecdd25846\n\n"}]}