feat: add commit signing #1142

kuwv · 2022-05-02T19:57:48Z

Overview

This pull request will add commit signing capability to the repository object. It is modeled off both the libgit2 and rugged implementations. It will allow integration with a 3rd party GPG signing tool.

References

#647
https://github.com/libgit2/rugged/blob/master/ext/rugged/rugged_commit.c#L791
https://github.com/libgit2/rugged/blob/master/ext/rugged/rugged_commit.c#L842
https://github.com/libgit2/pygit2/blob/master/test/test_commit_gpg.py
libgit2/libgit2#6293

kuwv · 2022-05-02T19:58:52Z

@jdavid I am currently writing the tests for this but I wanted to get this in front of you first.

jdavid · 2022-05-03T08:50:34Z

Thanks @kuwv, looks good.
There is some code duplication, but it doesn't look easy to avoid, so it's ok.
Only waiting for the tests then.

kuwv · 2022-05-03T13:14:31Z

Thanks @kuwv, looks good. There is some code duplication, but it doesn't look easy to avoid, so it's ok. Only waiting for the tests then.

Yeah, I guess two functions could potentially be combined later but I didn't want to introduce any breaking changes to the API. So, I choose to model Rugged and git2-rs.

One question, together neither function updates the HEAD reference. The Rugged implementation also does not. Should I add the reference update to commit_with_signature or should the API consumer do it?

Edit: Actually, I just remembered. I think I'd have to import an additional lib to perform the head update. I'll update the documentation for now instead.

jdavid · 2022-05-05T06:42:23Z

Please use gpgsigned.zip and remove gpgsigned.git

In my latest commit b472bda I've moved to use .zip files only, because with libgit2 1.4.3 there were ownership issues with .tar and raw .git data. I'm surprised that the tests pass for aarch64, but even then I think it's better to only use zip files.

kuwv · 2022-05-05T12:20:58Z

Please use gpgsigned.zip and remove gpgsigned.git

sure

I've moved to use .zip files only...

Yup, I saw that. Pardon my cruft, just needed to check.

Aside from that should I be worried about the appveyor tests?

kuwv · 2022-05-05T13:04:02Z

Alright, should be good now. Any additional changes you would like to see here?

Maybe shorten create_commit_with_signature to create_commit_signature or add_commit_signature?

jdavid · 2022-05-05T14:33:51Z

Aside from that should I be worried about the appveyor tests?

No, the appveyor tests are failing because of the upgrade to libgit2 v1.4.3, so it's unrelated.

Alright, should be good now. Any additional changes you would like to see here?

Only one last thing: can you rebase and squash?
At least commits e0880ce and c8e5509 should be squashed so we don't to keep .gpgsigned.git in history, which would add weight to the repo.

Maybe shorten create_commit_with_signature to create_commit_signature or add_commit_signature?

No, I think the current name is fine, we often follow libgit2's naming.

docs: add commit signing recipe test: cleanup unzipped cruft test: additional housekeeping test: additional housekeeping

kuwv · 2022-05-05T21:33:28Z

@jdavid Should be good now.

jdavid · 2022-05-06T06:08:20Z

Thanks!

1.10.1 (2022-08-28) ------------------------- - Fix segfault in ``Signature`` repr `#1155 <https://github.com/libgit2/pygit2/pull/1155>`_ - Linux and macOS wheels for Python 3.11 `#1154 <https://github.com/libgit2/pygit2/pull/1154>`_ 1.10.0 (2022-07-24) ------------------------- - Upgrade to libgit2 1.5 - Add support for ``GIT_OPT_GET_OWNER_VALIDATION`` and ``GIT_OPT_SET_OWNER_VALIDATION`` `#1150 <https://github.com/libgit2/pygit2/pull/1150>`_ - New ``untracked_files`` and ``ignored`` optional arguments for ``Repository.status(...)`` `#1151 <https://github.com/libgit2/pygit2/pull/1151>`_ 1.9.2 (2022-05-24) ------------------------- - New ``Repository.create_commit_string(...)`` and ``Repository.create_commit_with_signature(...)`` `#1142 <https://github.com/libgit2/pygit2/pull/1142>`_ - Linux and macOS wheels updated to libgit2 v1.4.3 - Remove redundant line `#1139 <https://github.com/libgit2/pygit2/pull/1139>`_ 1.9.1 (2022-03-22) ------------------------- - Type hints: added to C code and Branches/References `#1121 <https://github.com/libgit2/pygit2/pull/1121>`_ `#1132 <https://github.com/libgit2/pygit2/pull/1132>`_ - New ``Signature`` supports ``str()`` and ``repr()`` `#1135 <https://github.com/libgit2/pygit2/pull/1135>`_ - Fix ODB backend's read in big endian architectures `#1130 <https://github.com/libgit2/pygit2/pull/1130>`_ - Fix install with poetry `#1129 <https://github.com/libgit2/pygit2/pull/1129>`_ `#1128 <https://github.com/libgit2/pygit2/issues/1128>`_ - Wheels: update to libgit2 v1.4.2 - Tests: fix testing ``parse_diff`` `#1131 <https://github.com/libgit2/pygit2/pull/1131>`_ - CI: various fixes after migration to libgit2 v1.4 1.9.0 (2022-02-22) ------------------------- - Upgrade to libgit2 v1.4 - Documentation, new recipes for committing and cloning `#1125 <https://github.com/libgit2/pygit2/pull/1125>`_ 1.8.0 (2022-02-04) ------------------------- - Rename ``RemoteCallbacks.progress(...)`` callback to ``.sideband_progress(...)`` `#1120 <https://github.com/libgit2/pygit2/pull/1120>`_ - New ``Repository.merge_base_many(...)`` and ``Repository.merge_base_octopus(...)`` `#1112 <https://github.com/libgit2/pygit2/pull/1112>`_ - New ``Repository.listall_stashes()`` `#1117 <https://github.com/libgit2/pygit2/pull/1117>`_ - Code cleanup `#1118 <https://github.com/libgit2/pygit2/pull/1118>`_ Backward incompatible changes: - The ``RemoteCallbacks.progress(...)`` callback has been renamed to ``RemoteCallbacks.sideband_progress(...)``. This matches the documentation, but may break existing code that still uses the old name. 1.7.2 (2021-12-06) ------------------------- - Universal wheels for macOS `#1109 <https://github.com/libgit2/pygit2/pull/1109>`_ 1.7.1 (2021-11-19) ------------------------- - New ``Repository.amend_commit(...)`` `#1098 <https://github.com/libgit2/pygit2/pull/1098>`_ - New ``Commit.message_trailers`` `#1101 <https://github.com/libgit2/pygit2/pull/1101>`_ - Windows wheels for Python 3.10 `#1103 <https://github.com/libgit2/pygit2/pull/1103>`_ - Changed: now ``DiffDelta.is_binary`` returns ``None`` if the file data has not yet been loaded, cf. `#962 <https://github.com/libgit2/pygit2/issues/962>`_ - Document ``Repository.get_attr(...)`` and update theme `#1017 <https://github.com/libgit2/pygit2/issues/1017>`_ `#1105 <https://github.com/libgit2/pygit2/pull/1105>`_ 1.7.0 (2021-10-08) ------------------------- - Upgrade to libgit2 1.3.0 `#1089 <https://github.com/libgit2/pygit2/pull/1089>`_ - Linux wheels now bundled with libssh2 1.10.0 (instead of 1.9.0) - macOS wheels now include libssh2 - Add support for Python 3.10 `#1092 <https://github.com/libgit2/pygit2/pull/1092>`_ `#1093 <https://github.com/libgit2/pygit2/pull/1093>`_ - Drop support for Python 3.6 - New `pygit2.GIT_CHECKOUT_SKIP_LOCKED_DIRECTORIES` `#1087 <https://github.com/libgit2/pygit2/pull/1087>`_ - New optional argument ``location`` in ``Repository.applies(..)`` and ``Repository.apply(..)`` `#1091 <https://github.com/libgit2/pygit2/pull/1091>`_ - Fix: Now the `flags` argument in `Repository.blame()` is passed through `#1083 <https://github.com/libgit2/pygit2/pull/1083>`_ - CI: Stop using Travis, move to GitHub actions Caveats: - Windows wheels for Python 3.10 not yet available.

feat: add commit signing

56b7a20

kuwv mentioned this pull request May 2, 2022

GPG-signed commits #647

Open

kuwv mentioned this pull request May 5, 2022

Implement capability for tag signing libgit2/libgit2#6293

Closed

test: add commit signing

5749d4a

docs: add commit signing recipe test: cleanup unzipped cruft test: additional housekeeping test: additional housekeeping

kuwv force-pushed the commit-signing branch from 021f380 to 5749d4a Compare May 5, 2022 16:09

jdavid merged commit 74e114d into libgit2:master May 6, 2022

kuwv mentioned this pull request May 17, 2022

Project refresh wking/pyassuan#2

Open

kuwv mentioned this pull request Jan 25, 2023

Implement tag signing python-proman/versioning#10

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add commit signing #1142

feat: add commit signing #1142

kuwv commented May 2, 2022 •

edited

Loading

kuwv commented May 2, 2022

jdavid commented May 3, 2022

kuwv commented May 3, 2022 •

edited

Loading

jdavid commented May 5, 2022

kuwv commented May 5, 2022

kuwv commented May 5, 2022 •

edited

Loading

jdavid commented May 5, 2022

kuwv commented May 5, 2022

jdavid commented May 6, 2022

feat: add commit signing #1142

feat: add commit signing #1142

Conversation

kuwv commented May 2, 2022 • edited Loading

kuwv commented May 2, 2022

jdavid commented May 3, 2022

kuwv commented May 3, 2022 • edited Loading

jdavid commented May 5, 2022

kuwv commented May 5, 2022

kuwv commented May 5, 2022 • edited Loading

jdavid commented May 5, 2022

kuwv commented May 5, 2022

jdavid commented May 6, 2022

kuwv commented May 2, 2022 •

edited

Loading

kuwv commented May 3, 2022 •

edited

Loading

kuwv commented May 5, 2022 •

edited

Loading