Re: [PATCH] hooks/update: Add a hooks.denyunsignedtags option

From: Julian Andres Klode <jak@debian.org>
Date: Sep 12, 2015, 10:40 UTC
Message-ID: <20150912123905.GA15958@debian.org>
In-Reply-To: <1442054253-15780-1-git-send-email-jak@debian.org>

On Sat, Sep 12, 2015 at 12:37:33PM +0200, Julian Andres Klode wrote:

Show 16 quoted lines

> Introduce an option to deny unsigned tags from entering
> a repository. This is useful in teams where members forget
> to sign their release tags.
> 
> It does not actually check whether the signature is actually
> complete or valid, it just checks for the beginning of a
> signature, as further checks would be too involved.
> 
> This effectively also denies un-annotated tags, as those
> are unsigned by definition.
> 
> Signed-off-by: Julian Andres Klode <jak@debian.org>
> ---
>  templates/hooks--update.sample | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
>

[...]

Show 10 quoted lines

> @@ -86,6 +90,14 @@ case "$refname","$newrev_type" in
>  		;;
>  	refs/tags/*,tag)
>  		# annotated tag
> +		if [ "$denyunsignedtag" != "true" ] || git cat-file -p $newrev | grep -q 'BEGIN PGP SIGNATURE'; then
> +			:
> +		else
> +			echo "*** Tag '$refname' is unsigned"
> +			echo "*** Unsigned tags are not allowed in this repository." >&2
> +	                exit 1

There are some accidental space characters in front of that, this is fixed locally already. Sorry.

-- 
Julian Andres Klode  - Debian Developer, Ubuntu Member

See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.

Be friendly, do not top-post, and follow RFC 1855 "Netiquette".
    - If you don't I might ignore you.