fast-import: add 'abort-if-invalid' mode to '--signed-commits=<mode>'
The '--signed-commits=<mode>' option for git-fast-import(1) configures how signed commits are handled when encountered. In cases where an invalid commit signature is encountered, a user may wish to abort the operation entirely. Introduce an 'abort-if-invalid' mode to do so. Signed-off-by: Justin Tobler <jltobler@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Justin Tobler committed
Mar 26, 2026 at 14:14 UTC
4c36345e04cbef7edb94557119acba9f9a38c26f
6 files changed
+24
-3
Documentation/git-fast-import.adoc
+2
@@ -90,6 +90,8 @@ already trusted to run their own code.
90
commit signatures and replaces invalid signatures with newly created ones.
91
Valid signatures are left unchanged. If `<keyid>` is provided, that key is
92
used for signing; otherwise the configured default signing key is used.
93
+* `abort-if-invalid` will make this program die when encountering a signed
94
+ commit that is unable to be verified.
95
96
Options for Frontends
97
~~~~~~~~~~~~~~~~~~~~~
builtin/fast-export.c
+1
-1
@@ -65,7 +65,7 @@ static int parse_opt_sign_mode(const struct option *opt,
65
return 0;
66
67
if (parse_sign_mode(arg, val, NULL) || (*val == SIGN_STRIP_IF_INVALID) ||
68
- (*val == SIGN_SIGN_IF_INVALID))
68
+ (*val == SIGN_SIGN_IF_INVALID) || (*val == SIGN_ABORT_IF_INVALID))
69
return error(_("unknown %s mode: %s"), opt->long_name, arg);
70
71
return 0;
builtin/fast-import.c
+9
-1
@@ -2892,6 +2892,9 @@ static void handle_signature_if_invalid(struct strbuf *new_data,
2892
ret = verify_commit_buffer(tmp_buf.buf, tmp_buf.len, &signature_check);
2893
2894
if (ret) {
2895
+ if (mode == SIGN_ABORT_IF_INVALID)
2896
+ die(_("aborting due to invalid signature"));
2897
+
2898
warn_invalid_signature(&signature_check, msg->buf, mode);
2899
2900
if (mode == SIGN_SIGN_IF_INVALID) {
@@ -2983,6 +2986,7 @@ static void parse_new_commit(const char *arg)
2986
case SIGN_VERBATIM:
2987
case SIGN_STRIP_IF_INVALID:
2988
case SIGN_SIGN_IF_INVALID:
2989
+ case SIGN_ABORT_IF_INVALID:
2990
import_one_signature(&sig_sha1, &sig_sha256, v);
2991
break;
2992
@@ -3068,7 +3072,8 @@ static void parse_new_commit(const char *arg)
3072
encoding);
3073
3074
if ((signed_commit_mode == SIGN_STRIP_IF_INVALID ||
3071
- signed_commit_mode == SIGN_SIGN_IF_INVALID) &&
3075
+ signed_commit_mode == SIGN_SIGN_IF_INVALID ||
3076
+ signed_commit_mode == SIGN_ABORT_IF_INVALID) &&
3077
(sig_sha1.hash_algo || sig_sha256.hash_algo))
3078
handle_signature_if_invalid(&new_data, &sig_sha1, &sig_sha256,
3079
&msg, signed_commit_mode);
@@ -3115,6 +3120,9 @@ static void handle_tag_signature(struct strbuf *msg, const char *name)
3120
case SIGN_ABORT:
3121
die(_("encountered signed tag; use "
3122
"--signed-tags=<mode> to handle it"));
3123
+ case SIGN_ABORT_IF_INVALID:
3124
+ die(_("'abort-if-invalid' is not a valid mode for "
3125
+ "git fast-import with --signed-tags=<mode>"));
3126
case SIGN_STRIP_IF_INVALID:
3127
die(_("'strip-if-invalid' is not a valid mode for "
3128
"git fast-import with --signed-tags=<mode>"));
gpg-interface.c
+2
@@ -1164,6 +1164,8 @@ int parse_sign_mode(const char *arg, enum sign_mode *mode, const char **keyid)
1164
*mode = SIGN_WARN_STRIP;
1165
} else if (!strcmp(arg, "strip")) {
1166
*mode = SIGN_STRIP;
1167
+ } else if (!strcmp(arg, "abort-if-invalid")) {
1168
+ *mode = SIGN_ABORT_IF_INVALID;
1169
} else if (!strcmp(arg, "strip-if-invalid")) {
1170
*mode = SIGN_STRIP_IF_INVALID;
1171
} else if (!strcmp(arg, "sign-if-invalid")) {
gpg-interface.h
+1
@@ -115,6 +115,7 @@ void print_signature_buffer(const struct signature_check *sigc,
115
/* Modes for --signed-tags=<mode> and --signed-commits=<mode> options. */
116
enum sign_mode {
117
SIGN_ABORT,
118
+ SIGN_ABORT_IF_INVALID,
119
SIGN_WARN_VERBATIM,
120
SIGN_VERBATIM,
121
SIGN_WARN_STRIP,
t/t9305-fast-import-signatures.sh
+9
-1
@@ -103,7 +103,7 @@ test_expect_success RUST,GPG 'strip both OpenPGP signatures with --signed-commit
103
test_line_count = 2 out
104
'
105
106
-for mode in strip-if-invalid sign-if-invalid
106
+for mode in strip-if-invalid sign-if-invalid abort-if-invalid
107
do
108
test_expect_success GPG "import commit with no signature with --signed-commits=$mode" '
109
git fast-export main >output &&
@@ -135,6 +135,14 @@ do
135
# corresponding `data <length>` command would have to be changed too.
136
sed "s/OpenPGP signed commit/OpenPGP forged commit/" output >modified &&
137
138
+ if test "$mode" = abort-if-invalid
139
+ then
140
+ test_must_fail git -C new fast-import --quiet \
141
+ --signed-commits=$mode <modified >log 2>&1 &&
142
+ test_grep "aborting due to invalid signature" log &&
143
+ return 0
144
+ fi &&
145
+
146
git -C new fast-import --quiet --signed-commits=$mode <modified >log 2>&1 &&
147
148
IMPORTED=$(git -C new rev-parse --verify refs/heads/openpgp-signing) &&