mirror of
https://github.com/git/git
synced 2024-08-27 11:39:22 +00:00
pull: warn on --verify-signatures with --rebase
git-pull silently ignores the --verify-signatures option when running --rebase, potentially leaving users in the belief that the rebase operation would check for valid GPG signatures. Implementing --verify-signatures for git-rebase was talked about, but doubts for a valid workflow rose up. Since you usually merge other's branches into your branch you might have an interest that their side has a valid GPG signature. Rebasing, on the other hand, is to rebuild your branch on top of other's work, in order to push the result back, and it is too late to reject their work even if you find their commits lack acceptable signature. Let's warn users that the --verify-signatures option is ignored during "pull --rebase"; users do not wonder what would happen if their commits lack acceptable signature that way. Signed-off-by: Alexander Hirsch <1zeeky@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
3916adf997
commit
c57e501c51
|
@ -815,6 +815,9 @@ static int run_rebase(const unsigned char *curr_head,
|
|||
argv_array_push(&args, "--no-autostash");
|
||||
else if (opt_autostash == 1)
|
||||
argv_array_push(&args, "--autostash");
|
||||
if (opt_verify_signatures &&
|
||||
!strcmp(opt_verify_signatures, "--verify-signatures"))
|
||||
warning(_("ignoring --verify-signatures for rebase"));
|
||||
|
||||
argv_array_push(&args, "--onto");
|
||||
argv_array_push(&args, sha1_to_hex(merge_head));
|
||||
|
|
|
@ -341,6 +341,22 @@ test_expect_success 'branch.to-rebase.rebase should override pull.rebase' '
|
|||
test new = "$(git show HEAD:file2)"
|
||||
'
|
||||
|
||||
test_expect_success "pull --rebase warns on --verify-signatures" '
|
||||
git reset --hard before-rebase &&
|
||||
git pull --rebase --verify-signatures . copy 2>err &&
|
||||
test "$(git rev-parse HEAD^)" = "$(git rev-parse copy)" &&
|
||||
test new = "$(git show HEAD:file2)" &&
|
||||
test_i18ngrep "ignoring --verify-signatures for rebase" err
|
||||
'
|
||||
|
||||
test_expect_success "pull --rebase does not warn on --no-verify-signatures" '
|
||||
git reset --hard before-rebase &&
|
||||
git pull --rebase --no-verify-signatures . copy 2>err &&
|
||||
test "$(git rev-parse HEAD^)" = "$(git rev-parse copy)" &&
|
||||
test new = "$(git show HEAD:file2)" &&
|
||||
test_i18ngrep ! "verify-signatures" err
|
||||
'
|
||||
|
||||
# add a feature branch, keep-merge, that is merged into master, so the
|
||||
# test can try preserving the merge commit (or not) with various
|
||||
# --rebase flags/pull.rebase settings.
|
||||
|
|
Loading…
Reference in a new issue