Re: GPG signing for git commit?

[Nguyen Thai Ngoc Duy <pclouds@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1172 bytes --]

On Mon, May 11, 2009 at 8:53 AM, Nguyen Thai Ngoc Duy <pclouds@gmail.com> wrote:
> On Sat, May 9, 2009 at 5:03 AM, Robin H. Johnson <robbat2@gentoo.org> wrote:
>>> How about signing the tree SHA-1 and putting the signature in commit
>>> message? It's like gpg way of saying Signed-off-by. If the committer
>>> wants to sign again before pushing out, he could amend the commit,
>>> append his signature there; or make a no-change commit to contain his
>>> signature (probably from git-commit-tree because iirc git-commit won't
>>> let you make no-change commit)
>> Hmm, I like the sound of that, but I'm concerned it might be difficult
>> to enforce. If rewrite-history ever happens, it's also invalidated.
>
> Well if you rewrite and touch the trees, then every signature should
> be invalidated anyway. If you only touch commit message, it should
> remain valid because I only sign trees.

I went ahead and made two scripts git-gpg-sign and git-gpg-verify to
see if it works. Things that are signed in these scripts:
 - tree
 - parents
 - any other gpg signature
You probably don't want to sign the same commit too many times because
the signature will get huge.
-- 
Duy

[-- Attachment #2: git-gpg-sign --]
[-- Type: application/octet-stream, Size: 601 bytes --]

#!/bin/sh
PGP='/^-----BEGIN PGP MESSAGE-----$/,/^-----END PGP MESSAGE-----$/'
COMMIT_GPGMSG="$(git rev-parse --git-dir)"/COMMIT_GPGMSG
GPGMSG="$(git rev-parse --git-dir)"/GPGMSG
git cat-file -p HEAD | sed -ne '1,/^$/p' | egrep '^tree |^parent ' > "$GPGMSG"

#if it's not valid, just drop it
git cat-file -p HEAD | grep -q '^-----BEGIN PGP MESSAGE-----$' &&
	git gpg-verify &&
	git cat-file -p HEAD | sed -ne "$PGP"p >> "$GPGMSG"
git cat-file -p HEAD | sed -e '1,/^$/d' | sed -e "$PGP"d > "$COMMIT_GPGMSG"
gpg --sign --armor -o - "$GPGMSG" >> "$COMMIT_GPGMSG"
git commit --amend -F "$COMMIT_GPGMSG" -e

[-- Attachment #3: git-gpg-verify --]
[-- Type: application/octet-stream, Size: 563 bytes --]

#!/bin/sh

die() {
	echo "$@"
	exit 1
}

PGP='/^-----BEGIN PGP MESSAGE-----$/,/^-----END PGP MESSAGE-----$/'
C="$1"
GPGMSG1="$(git rev-parse --git-dir)"/GPGMSG1
GPGMSG2="$(git rev-parse --git-dir)"/GPGMSG2
[ -n "$1" ] || C=HEAD
git cat-file commit $C > "$GPGMSG1"
while grep -q '^-----BEGIN PGP MESSAGE-----$' "$GPGMSG1";do
	[ -f "$GPGMSG2" ] && rm -f "$GPGMSG2"
	gpg -o "$GPGMSG2" "$GPGMSG1" || die "Failed to verify"
	mv "$GPGMSG2" "$GPGMSG1"
done
git cat-file commit $C | sed -ne '1,/^$/p' | egrep '^tree |^parent '|cmp -s "$GPGMSG1" || die "Failed to verify"