diff options
| author | Justin Tobler <jltobler@gmail.com> | 2026-03-26 14:14:14 -0500 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2026-03-26 12:42:58 -0700 |
| commit | ddd7c7ab12a25850e96f550567ef06fb9bea0cc0 (patch) | |
| tree | ffddebd4f66f90f80569eab998212d3895fa7378 /t | |
| parent | 2b1546c03cc3e02e51261fa38fe47a4f1b4e295b (diff) | |
| download | git-ddd7c7ab12a25850e96f550567ef06fb9bea0cc0.tar.xz | |
fast-import: add 'abort-if-invalid' mode to '--signed-tags=<mode>'
In git-fast-import(1), the 'abort-if-invalid' mode for the
'--signed-commits' option verifies commit signatures during import and
aborts the entire operation when verification fails. Extend the same
behavior to signed tag objects by introducing an 'abort-if-invalid' mode
for the '--signed-tags' option.
Signed-off-by: Justin Tobler <jltobler@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't')
| -rwxr-xr-x | t/t9306-fast-import-signed-tags.sh | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/t/t9306-fast-import-signed-tags.sh b/t/t9306-fast-import-signed-tags.sh index bb4c8008ef..ec2b241cdb 100755 --- a/t/t9306-fast-import-signed-tags.sh +++ b/t/t9306-fast-import-signed-tags.sh @@ -77,7 +77,7 @@ test_expect_success GPGSSH 'import SSH signed tag with --signed-tags=strip' ' test_grep ! "SSH SIGNATURE" out ' -for mode in strip-if-invalid sign-if-invalid +for mode in strip-if-invalid sign-if-invalid abort-if-invalid do test_expect_success GPG "import tag with no signature with --signed-tags=$mode" ' test_when_finished rm -rf import && @@ -112,6 +112,14 @@ do # `data <length>` command would have to be changed too. sed "s/OpenPGP signed tag/OpenPGP forged tag/" output >modified && + if test "$mode" = abort-if-invalid + then + test_must_fail git -C import fast-import --quiet \ + --signed-tags=$mode <modified >log 2>&1 && + test_grep "aborting due to invalid signature" log && + return 0 + fi && + git -C import fast-import --quiet --signed-tags=$mode <modified >log 2>&1 && IMPORTED=$(git -C import rev-parse --verify refs/tags/openpgp-signed) && |