Skip to content

Commit 6d2035e

Browse files
gitstergitster
committed
Merge branch 'jk/verify-sig-merge-into-void'
"git merge" and "git pull" that merges into an unborn branch used to completely ignore "--verify-signatures", which has been corrected. * jk/verify-sig-merge-into-void: pull: handle --verify-signatures for unborn branch merge: handle --verify-signatures for unborn branch merge: extract verify_merge_signature() helper
2 parents 3984764 + 01a31f3 commit 6d2035e

6 files changed

Lines changed: 64 additions & 25 deletions

File tree

‎builtin/merge.c‎

Lines changed: 5 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1337,6 +1337,10 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
13371337
die(_("%s - not something we can merge"), argv[0]);
13381338
if (remoteheads->next)
13391339
die(_("Can merge only exactly one commit into empty head"));
1340+
1341+
if (verify_signatures)
1342+
verify_merge_signature(remoteheads->item, verbosity);
1343+
13401344
remote_head_oid = &remoteheads->item->object.oid;
13411345
read_empty(remote_head_oid, 0);
13421346
update_ref("initial pull", "HEAD", remote_head_oid, NULL, 0,
@@ -1358,31 +1362,7 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
13581362

13591363
if (verify_signatures) {
13601364
for (p = remoteheads; p; p = p->next) {
1361-
struct commit *commit = p->item;
1362-
char hex[GIT_MAX_HEXSZ + 1];
1363-
struct signature_check signature_check;
1364-
memset(&signature_check, 0, sizeof(signature_check));
1365-
1366-
check_commit_signature(commit, &signature_check);
1367-
1368-
find_unique_abbrev_r(hex, &commit->object.oid, DEFAULT_ABBREV);
1369-
switch (signature_check.result) {
1370-
case 'G':
1371-
break;
1372-
case 'U':
1373-
die(_("Commit %s has an untrusted GPG signature, "
1374-
"allegedly by %s."), hex, signature_check.signer);
1375-
case 'B':
1376-
die(_("Commit %s has a bad GPG signature "
1377-
"allegedly by %s."), hex, signature_check.signer);
1378-
default: /* 'N' */
1379-
die(_("Commit %s does not have a GPG signature."), hex);
1380-
}
1381-
if (verbosity >= 0 && signature_check.result == 'G')
1382-
printf(_("Commit %s has a good GPG signature by %s\n"),
1383-
hex, signature_check.signer);
1384-
1385-
signature_check_clear(&signature_check);
1365+
verify_merge_signature(p->item, verbosity);
13861366
}
13871367
}
13881368

‎builtin/pull.c‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,17 @@ static int run_fetch(const char *repo, const char **refspecs)
557557
static int pull_into_void(const struct object_id *merge_head,
558558
const struct object_id *curr_head)
559559
{
560+
if (opt_verify_signatures) {
561+
struct commit *commit;
562+
563+
commit = lookup_commit(the_repository, merge_head);
564+
if (!commit)
565+
die(_("unable to access commit %s"),
566+
oid_to_hex(merge_head));
567+
568+
verify_merge_signature(commit, opt_verbosity);
569+
}
570+
560571
/*
561572
* Two-way merge: we treat the index as based on an empty tree,
562573
* and try to fast-forward to HEAD. This ensures we will not lose

‎commit.c‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1099,7 +1099,33 @@ int check_commit_signature(const struct commit *commit, struct signature_check *
10991099
return ret;
11001100
}
11011101

1102+
void verify_merge_signature(struct commit *commit, int verbosity)
1103+
{
1104+
char hex[GIT_MAX_HEXSZ + 1];
1105+
struct signature_check signature_check;
1106+
memset(&signature_check, 0, sizeof(signature_check));
1107+
1108+
check_commit_signature(commit, &signature_check);
1109+
1110+
find_unique_abbrev_r(hex, &commit->object.oid, DEFAULT_ABBREV);
1111+
switch (signature_check.result) {
1112+
case 'G':
1113+
break;
1114+
case 'U':
1115+
die(_("Commit %s has an untrusted GPG signature, "
1116+
"allegedly by %s."), hex, signature_check.signer);
1117+
case 'B':
1118+
die(_("Commit %s has a bad GPG signature "
1119+
"allegedly by %s."), hex, signature_check.signer);
1120+
default: /* 'N' */
1121+
die(_("Commit %s does not have a GPG signature."), hex);
1122+
}
1123+
if (verbosity >= 0 && signature_check.result == 'G')
1124+
printf(_("Commit %s has a good GPG signature by %s\n"),
1125+
hex, signature_check.signer);
11021126

1127+
signature_check_clear(&signature_check);
1128+
}
11031129

11041130
void append_merge_tag_headers(struct commit_list *parents,
11051131
struct commit_extra_header ***tail)

‎commit.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,14 @@ void record_author_date(struct author_date_slab *author_date,
340340
struct commit *commit);
341341

342342
int compare_commits_by_author_date(const void *a_, const void *b_, void *unused);
343+
344+
/*
345+
* Verify a single commit with check_commit_signature() and die() if it is not
346+
* a good signature. This isn't really suitable for general use, but is a
347+
* helper to implement consistent logic for pull/merge --verify-signatures.
348+
*/
349+
void verify_merge_signature(struct commit *commit, int verbose);
350+
343351
int compare_commits_by_commit_date(const void *a_, const void *b_, void *unused);
344352
int compare_commits_by_gen_then_commit_date(const void *a_, const void *b_, void *unused);
345353

‎t/t5573-pull-verify-signatures.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,4 +78,11 @@ test_expect_success GPG 'pull commit with bad signature with --no-verify-signatu
7878
git pull --ff-only --no-verify-signatures bad 2>pullerror
7979
'
8080

81+
test_expect_success GPG 'pull unsigned commit into unborn branch' '
82+
git init empty-repo &&
83+
test_must_fail \
84+
git -C empty-repo pull --verify-signatures .. 2>pullerror &&
85+
test_i18ngrep "does not have a GPG signature" pullerror
86+
'
87+
8188
test_done

‎t/t7612-merge-verify-signatures.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,4 +103,11 @@ test_expect_success GPG 'merge commit with bad signature with merge.verifySignat
103103
git merge --no-verify-signatures $(cat forged.commit)
104104
'
105105

106+
test_expect_success GPG 'merge unsigned commit into unborn branch' '
107+
test_when_finished "git checkout initial" &&
108+
git checkout --orphan unborn &&
109+
test_must_fail git merge --verify-signatures side-unsigned 2>mergeerror &&
110+
test_i18ngrep "does not have a GPG signature" mergeerror
111+
'
112+
106113
test_done

0 commit comments

Comments
 (0)