[PATCH] hooks/update: Add a...

[PATCH] hooks/update: Add a hooks.denyunsignedtags option

From: Julian Andres Klode <hidden>
Date: 2016-06-15 23:07:32

Introduce an option to deny unsigned tags from entering
a repository. This is useful in teams where members forget
to sign their release tags.

It does not actually check whether the signature is actually
complete or valid, it just checks for the beginning of a
signature, as further checks would be too involved.

This effectively also denies un-annotated tags, as those
are unsigned by definition.

Signed-off-by: Julian Andres Klode <redacted>
---

Note: Submitted for review on Sep 12, re-asked on Sep 22, but
no feedback, so I assume it's good to go, see
http://thread.gmane.org/gmane.comp.version-control.git/277722
for details

 templates/hooks--update.sample | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/templates/hooks--update.sample b/templates/hooks--update.sample
index d847583..e261d30 100755
--- a/templates/hooks--update.sample
+++ b/templates/hooks--update.sample

@@ -16,6 +16,9 @@
 # hooks.allowmodifytag
 #   This boolean sets whether a tag may be modified after creation. By default
 #   it won't be.
+# hooks.denyunsignedtag
+#   This boolean sets whether creating unsigned tags will be denied. By
+#   default this is allowed.
 # hooks.allowdeletebranch
 #   This boolean sets whether deleting branches will be allowed in the
 #   repository.  By default they won't be.

@@ -48,6 +51,7 @@ allowdeletebranch=$(git config --bool hooks.allowdeletebranch)
 denycreatebranch=$(git config --bool hooks.denycreatebranch)
 allowdeletetag=$(git config --bool hooks.allowdeletetag)
 allowmodifytag=$(git config --bool hooks.allowmodifytag)
+denyunsignedtag=$(git config --bool hooks.denyunsignedtag)
 
 # check for no description
 projectdesc=$(sed -e '1q' "$GIT_DIR/description")

@@ -71,7 +75,7 @@ case "$refname","$newrev_type" in
 	refs/tags/*,commit)
 		# un-annotated tag
 		short_refname=${refname##refs/tags/}
-		if [ "$allowunannotated" != "true" ]; then
+		if [ "$allowunannotated" != "true" ] || [ "$denyunsignedtag" = "true" ]; then
 			echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2
 			echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2
 			exit 1

@@ -86,6 +90,14 @@ case "$refname","$newrev_type" in
 		;;
 	refs/tags/*,tag)
 		# annotated tag
+		if [ "$denyunsignedtag" != "true" ] || git cat-file -p $newrev | grep -q 'BEGIN PGP SIGNATURE'; then
+			:
+		else
+			echo "*** Tag '$refname' is unsigned"
+			echo "*** Unsigned tags are not allowed in this repository." >&2
+			exit 1
+		fi
+
 		if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1
 		then
 			echo "*** Tag '$refname' already exists." >&2

-- 
2.6.4

Re: [PATCH] hooks/update: Add a hooks.denyunsignedtags option

From: Eric Sunshine <hidden>
Date: 2016-06-15 23:07:32

On Monday, December 21, 2015, Julian Andres Klode [off-list ref] wrote:

quoted hunk

Introduce an option to deny unsigned tags from entering
a repository. This is useful in teams where members forget
to sign their release tags.

It does not actually check whether the signature is actually
complete or valid, it just checks for the beginning of a
signature, as further checks would be too involved.

This effectively also denies un-annotated tags, as those
are unsigned by definition.

Signed-off-by: Julian Andres Klode <redacted>
---

diff --git a/templates/hooks--update.sample b/templates/hooks--update.sample

@@ -71,7 +75,7 @@ case "$refname","$newrev_type" in
        refs/tags/*,commit)
                # un-annotated tag
                short_refname=${refname##refs/tags/}
-               if [ "$allowunannotated" != "true" ]; then
+               if [ "$allowunannotated" != "true" ] || [ "$denyunsignedtag" = "true" ]; then
                        echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2
                        echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2

Hmm. Is this diagnostic sufficient to help the person resolve the
issue? Isn't it actively misleading to advise using '-a'? Perhaps a
distinct message is warranted?

(Alternately, if you follow Junio's advice and disallow this
combination of options, then this issue becomes moot.)

quoted hunk

                        exit 1

@@ -86,6 +90,14 @@ case "$refname","$newrev_type" in
                ;;
        refs/tags/*,tag)
                # annotated tag
+               if [ "$denyunsignedtag" != "true" ] || git cat-file -p $newrev | grep -q 'BEGIN PGP SIGNATURE'; then
+                       :
+               else
+                       echo "*** Tag '$refname' is unsigned"
+                       echo "*** Unsigned tags are not allowed in this repository." >&2

The diagnostic for $allowunannotated gives helpful advice about how to
resolve the problem. Should this one follow suit?

Also consistency might suggest patterning this message after the one
for $allowunannotated. Perhaps something like this:

    The unsigned tag $short_refname is not allowed in this repository.
    Use 'git tag -s' for tags you want to propagate.

or something.

+                       exit 1
+               fi
+
                if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1
                then
                        echo "*** Tag '$refname' already exists." >&2
--
2.6.4

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help