tag: add tag.gpgSign config option to force all tags be GPG-signed
As many CI/CD tools don't allow to control command line options when executing `git tag` command, a default value in the configuration file will allow to enforce tag signing if required. The new config-file option tag.gpgSign is added to define default behavior of tag signings. To override default behavior the command line option -s, --sign and --no-sign can be used: $ git tag -m "commit message" will generate a GPG signed tag if tag.gpgSign option is true, while $ git tag --no-sign -m "commit message" will skip the signing step. Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Tigran Mkrtchyan committed
Jun 5, 2019 at 23:33 UTC
1c6b565f896c27dc7c52aa3af9c7dcfc7934e8fe
4 files changed
+52
-6
Documentation/config/tag.txt
+8
@@ -8,6 +8,14 @@ tag.sort::
8
linkgit:git-tag[1]. Without the "--sort=<value>" option provided, the
9
value of this variable will be used as the default.
10
11
+tag.gpgSign::
12
+ A boolean to specify whether all tags should be GPG signed.
13
+ Use of this option when running in an automated script can
14
+ result in a large number of tags being signed. It is therefore
15
+ convenient to use an agent to avoid typing your gpg passphrase
16
+ several times. Note that this option doesn't affects tag signing
17
+ behavior enabled by "-u <keyid>" or "--local-user=<keyid>" options.
18
+
19
tar.umask::
20
This variable can be used to restrict the permission bits of
21
tar archive entries. The default is 0002, which turns off the
Documentation/git-tag.txt
+7
@@ -64,6 +64,13 @@ OPTIONS
64
-s::
65
--sign::
66
Make a GPG-signed tag, using the default e-mail address's key.
67
+ The default behavior of tag GPG-signing is controlled by `tag.gpgSign`
68
+ configuration variable if it exists, or disabled oder otherwise.
69
+ See linkgit:git-config[1].
70
+
71
+--no-sign::
72
+ Override `tag.gpgSign` configuration variable that is
73
+ set to force each and every tag to be signed.
74
75
-u <keyid>::
76
--local-user=<keyid>::
builtin/tag.c
+16
-6
@@ -33,6 +33,7 @@ static const char * const git_tag_usage[] = {
33
34
static unsigned int colopts;
35
static int force_sign_annotate;
36
+static int config_sign_tag = -1; /* unspecified */
37
38
static int list_tags(struct ref_filter *filter, struct ref_sorting *sorting,
39
struct ref_format *format)
@@ -144,6 +145,11 @@ static int git_tag_config(const char *var, const char *value, void *cb)
145
int status;
146
struct ref_sorting **sorting_tail = (struct ref_sorting **)cb;
147
148
+ if (!strcmp(var, "tag.gpgsign")) {
149
+ config_sign_tag = git_config_bool(var, value);
150
+ return 0;
151
+ }
152
+
153
if (!strcmp(var, "tag.sort")) {
154
if (!value)
155
return config_error_nonbool(var);
@@ -442,15 +448,10 @@ int cmd_tag(int argc, const char **argv, const char *prefix)
448
memset(&opt, 0, sizeof(opt));
449
memset(&filter, 0, sizeof(filter));
450
filter.lines = -1;
451
+ opt.sign = -1;
452
453
argc = parse_options(argc, argv, prefix, options, git_tag_usage, 0);
454
448
- if (keyid) {
449
- opt.sign = 1;
450
- set_signing_key(keyid);
451
- }
452
- create_tag_object = (opt.sign || annotate || msg.given || msgfile);
453
-
455
if (!cmdmode) {
456
if (argc == 0)
457
cmdmode = 'l';
@@ -463,6 +464,15 @@ int cmd_tag(int argc, const char **argv, const char *prefix)
464
if (cmdmode == 'l')
465
setup_auto_pager("tag", 1);
466
467
+ if (opt.sign == -1)
468
+ opt.sign = cmdmode ? 0 : config_sign_tag > 0;
469
+
470
+ if (keyid) {
471
+ opt.sign = 1;
472
+ set_signing_key(keyid);
473
+ }
474
+ create_tag_object = (opt.sign || annotate || msg.given || msgfile);
475
+
476
if ((create_tag_object || force) && (cmdmode != 0))
477
usage_with_options(git_tag_usage, options);
478
t/t7004-tag.sh
+21
@@ -932,6 +932,27 @@ test_expect_success GPG \
932
test_cmp expect actual
933
'
934
935
+get_tag_header gpgsign-enabled $commit commit $time >expect
936
+echo "A message" >>expect
937
+echo '-----BEGIN PGP SIGNATURE-----' >>expect
938
+test_expect_success GPG \
939
+ 'git tag configured tag.gpgsign enables GPG sign' \
940
+ 'test_config tag.gpgsign true &&
941
+ git tag -m "A message" gpgsign-enabled &&
942
+ get_tag_msg gpgsign-enabled>actual &&
943
+ test_cmp expect actual
944
+'
945
+
946
+get_tag_header no-sign $commit commit $time >expect
947
+echo "A message" >>expect
948
+test_expect_success GPG \
949
+ 'git tag --no-sign configured tag.gpgsign skip GPG sign' \
950
+ 'test_config tag.gpgsign true &&
951
+ git tag -a --no-sign -m "A message" no-sign &&
952
+ get_tag_msg no-sign>actual &&
953
+ test_cmp expect actual
954
+'
955
+
956
test_expect_success GPG \
957
'trying to create a signed tag with non-existing -F file should fail' '
958
! test -f nonexistingfile &&