@matheusbsbs / matheus-bagliano / commits / 6694856153

commit-tree: do not pay attention to commit.gpgsign

ba3c69a9 (commit: teach --gpg-sign option, 2011-10-05) introduced a "signed commit" by teaching the --[no]-gpg-sign option and the commit.gpgsign configuration variable to various commands that create commits. Teaching these to "git commit" and "git merge", both of which are end-user facing Porcelain commands, was perfectly fine. Allowing the plumbing "git commit-tree" to suddenly change the behaviour to surprise the scripts by paying attention to commit.gpgsign was not. Among the in-tree scripts, filter-branch, quiltimport, rebase and stash are the commands that run "commit-tree". If any of these wants to allow users to always sign every single commit, they should offer their own configuration (e.g. "filterBranch.gpgsign") with an option to disable signing (e.g. "git filter-branch --no-gpgsign"). Ignoring commit.gpgsign option _obviously_ breaks the backward compatibility, but it is easy to follow the standard pattern in scripts to honor whatever configuration variable they choose to follow. E.g. case $(git config --bool commit.gpgsign) in true) sign=-S ;; *) sign= ;; esac && git commit-tree $sign ...whatever other args... Do so to make sure that "git rebase" keeps paying attention to the configuration variable, which unfortunately is a documented mistake. Helped-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Junio C Hamano committed May 2, 2016 at 14:58 UTC 6694856153f85cb552cc92d75ddeabf5bdec4f20
4 files changed +16 -10
Documentation/git-commit-tree.txt
+2 -2
@@ -59,8 +59,8 @@ OPTIONS
59 GPG-sign commit.
60
61 --no-gpg-sign::
62 - Countermand `commit.gpgSign` configuration variable that is
63 - set to force each and every commit to be signed.
62 + Do not GPG-sign commit, to countermand a `--gpg-sign` option
63 + given earlier on the command line.
64
65
66 Commit Information
builtin/commit-tree.c
-4
@@ -33,10 +33,6 @@ static int commit_tree_config(const char *var, const char *value, void *cb)
33 int status = git_gpg_config(var, value, NULL);
34 if (status)
35 return status;
36 - if (!strcmp(var, "commit.gpgsign")) {
37 - sign_commit = git_config_bool(var, value) ? "" : NULL;
38 - return 0;
39 - }
36 return git_default_config(var, value, cb);
37 }
38
git-rebase.sh
+4 -1
@@ -87,7 +87,10 @@ preserve_merges=
87 autosquash=
88 keep_empty=
89 test "$(git config --bool rebase.autosquash)" = "true" && autosquash=t
90 -gpg_sign_opt=
90 +case "$(git config --bool commit.gpgsign)" in
91 +true) gpg_sign_opt=-S ;;
92 +*) gpg_sign_opt= ;;
93 +esac
94
95 read_basic_state () {
96 test -f "$state_dir/head-name" &&
t/t7510-signed-commit.sh
+10 -3
@@ -45,12 +45,18 @@ test_expect_success GPG 'create signed commits' '
45 git tag seventh-signed &&
46
47 echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
48 - git tag eighth-signed-alt
48 + git tag eighth-signed-alt &&
49 +
50 + # commit.gpgsign is still on but this must not be signed
51 + git tag ninth-unsigned $(echo 9 | git commit-tree HEAD^{tree}) &&
52 + # explicit -S of course must sign.
53 + git tag tenth-signed $(echo 9 | git commit-tree -S HEAD^{tree})
54 '
55
56 test_expect_success GPG 'verify and show signatures' '
57 (
53 - for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
58 + for commit in initial second merge fourth-signed \
59 + fifth-signed sixth-signed seventh-signed tenth-signed
60 do
61 git verify-commit $commit &&
62 git show --pretty=short --show-signature $commit >actual &&
@@ -60,7 +66,8 @@ test_expect_success GPG 'verify and show signatures' '
66 done
67 ) &&
68 (
63 - for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
69 + for commit in merge^2 fourth-unsigned sixth-unsigned \
70 + seventh-unsigned ninth-unsigned
71 do
72 test_must_fail git verify-commit $commit &&
73 git show --pretty=short --show-signature $commit >actual &&