{"thread":{"id":"60474","subject":"An analogue for commit.gpgsign but for verifying signatures on each pull","startedAt":"2023-11-06T05:34:28Z","lastAt":"2023-11-06T05:34:28Z","messageCount":1,"participants":["luckyguy@mailbox.org"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"484449","messageId":"133794934.122939.1699248859628@office.mailbox.org","threadId":"60474","inReplyTo":null,"subject":"An analogue for commit.gpgsign but for verifying signatures on each pull","fromName":"","fromEmail":"luckyguy@mailbox.org","sentAt":"2023-11-06T05:34:19Z","receivedAt":"2023-11-06T05:34:28Z","isPatch":false,"sender":{"key":"luckyguy@mailbox.org","avatar":null},"body":"Hello. I apologize if this question has been asked before.\n\nIs there anyway I can configure git to *automatically* verify the signature of the HEAD of any branch it pulls and fail if that signature is bad or missing? I'm hoping for something as convenient as `commit.gpgSign` that can be configured globally.\n\nI can, of course, do this \"manually\" but others may forget or may not be knowledgeable to do this on their own. I would like git to locally enforce this, rather than some upstream server, so that new commits don't accidentally get built on top of bad commits. \n\nIf no such functionality exists in git today, then I humbly ask that this feature be considered. Perhaps `pull.gpgVerify`?\n\nThank you for your time.\n"}]}