问题描述
然后制作（如果）可以将签名部分限制为将作为贡献合并的提交
有关该过程的更多详细信息：
- （对于gpg部分）
所以如果你的持续集成构建只合并request-pull（用于），你可以检查这些特定的提交是否已签名（如果它们不是）。
这个脚本就是这样一个检查的例子：。
Github supports signing commits with a PGP key.
We have an open source project, that accepts contributors from people without PGP keys. Security is essential for us, and so we decided that each person who merges pull requests will sign the merges with his PGP key, and so each actual commit will either be directly signed by the author, and/or by the merger.
What is the best way to setup a continous integration build that makes sure this actually happens? We want the build to fail, alarms to go off, and possibly the commit/merge reverted, if anyone commits or merges code into the main repo, without signing it with a PGP key from a given list of authorized keys.
We are using github, so I wonder is github hooks may help. I believe we're using Jenkins for CI, however that probablly doesn't matter as it's going to be a custom script.
To clarify: The project accepts contributions from open source developers, and we won't require each of these to have a PGP key. However, each of the people with merge rights in github must have a PGP key, and the build I propose will verify this. The merge-commits themselves are going to be PGP-signed, even if not every commit is.
Update (April 2016)
See "GitHub GPG signature verification":
Original answer (June 2014)
From your edit, you went with option 2 in the paper "A Git Horror Story: Repository Integrity With Signed Commits":
Then making a signed request-pull (which can be always signed if commit.gpgsign is set) can limit the signing part to the commits that will be merged as contribution-commits only (as opposed to any random merge between two branches).
More details on that process on:
- "How to use a signed tag in pull requests"
- ""Pulling signed tag" is already in use in the field"
- "Using a GPG Key to Sign-Off Git Commits and Emails" (for the gpg part)
So if your continuous integration build only merges request-pull (used in this test script), you can check if those specific commits are signed (and don't merge them if they are not).
This script is an example of such a check: "check-commit-signature".
这篇关于如何自动验证所有提交者PGP签名他们的提交的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！