git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 0/3] More on pulling signed tags

From
Junio C Hamano <gitster@pobox.com>
Date
Jan 4, 2012, 22:10 UTC
Message-ID
<1325715058-11984-1-git-send-email-gitster@pobox.com>

This extends on the earlier topic to pull and merge signed tags. So far, we did record them for later auditing, but did not have an easy way to perform the auditing, other than manually extracting the information from the commit object.

Applies on top of the merge between the current 'master' and the 'jc/signed-commit' topic still in 'next', as the latter topic already has necessary infrastructure to hook into the "log" machinery to show the signatures embedded in commit objects with the "--show-signature" option.

Help on adding tests, docs and tying loose ends are very much appreciated.
A sample workflow with the command may look like this:
  $ git checkout v1.7.8^0
  $ git pull $elsewhere v1.7.8.2
  $ git show -s --show-signature
  commit e00ee29c760ae27c177ec16adb8c94b85909f464
  parent #2, tagged 'v1.7.8.2'
  gpg: Signature made Wed 28 Dec 2011 12:03:39 PM PST using RSA key ID 96AFE6CB
  gpg: Good signature from "Junio C Hamano <gitster@pobox.com>"
  gpg:                 aka "Junio C Hamano <junio@pobox.com>"
  gpg:                 aka "Junio C Hamano <jch@google.com>"
  Merge: 406da78 f3f778d
  Author: Junio C Hamano <gitster@pobox.com>
  Date:   Wed Jan 4 14:05:03 2012 -0800
      Merge tag 'v1.7.8.2' of ../git into HEAD
      Git 1.7.8.2
  $ git commit -S --amend --no-edit
  commit df409f0d0b1f3f521dd0fd2baf6ecf01495c0191
  gpg: Signature made Wed 04 Jan 2012 02:05:26 PM PST using RSA key ID 96AFE6CB
  gpg: Good signature from "Junio C Hamano <gitster@pobox.com>"
  gpg:                 aka "Junio C Hamano <junio@pobox.com>"
  gpg:                 aka "Junio C Hamano <jch@google.com>"
  parent #2, tagged 'v1.7.8.2'
  gpg: Signature made Wed 28 Dec 2011 12:03:39 PM PST using RSA key ID 96AFE6CB
  gpg: Good signature from "Junio C Hamano <gitster@pobox.com>"
  gpg:                 aka "Junio C Hamano <junio@pobox.com>"
  gpg:                 aka "Junio C Hamano <jch@google.com>"
  Merge: 406da78 f3f778d
  Author: Junio C Hamano <gitster@pobox.com>
  Date:   Wed Jan 4 14:05:03 2012 -0800
      Merge tag 'v1.7.8.2' of ../git into HEAD
      Git 1.7.8.2
Junio C Hamano (3):
  verify_signed_buffer: fix stale comment
  log-tree.c: small refactor in show_signature()
  log-tree: show mergetag in log --show-signature output
 gpg-interface.c |    5 +--
 log-tree.c      |  104 ++++++++++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 92 insertions(+), 17 deletions(-)
-- 
1.7.8.2.340.gd18f0f
Next: Junio C Hamano
Message 1 of 7 in “More on pulling signed tags”
  1. 0/3 More on pulling signed tagsJunio C Hamano, Jan 4, 2012
  2. 1/3 verify_signed_buffer: fix stale commentJunio C Hamano, Jan 4, 2012
  3. 2/3 log-tree.c: small refactor in show_signature()Junio C Hamano, Jan 4, 2012
  4. 3/3 log-tree: show mergetag in log --show-signature outputJunio C Hamano, Jan 4, 2012
  5. Junio C HamanoJan 5, 2012
  6. Junio C HamanoJan 5, 2012
  7. Linus TorvaldsJan 5, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.