pull: handle --verify-signatures for unborn branch

We usually just forward the --verify-signatures option along to
git-merge, and trust it to do the right thing. However, when we are on
an unborn branch (i.e., there is no HEAD yet), we handle this case
ourselves without even calling git-merge. And in this code path, we do
not respect the verification option at all.

It may be more maintainable in the long run to call git-merge for the
unborn case. That would fix this bug, as well as prevent similar ones in
the future. But unfortunately it's not easy to do. As t5520.3
demonstrates, there are some special cases that git-merge does not
handle, like "git pull .. master:master" (by the time git-merge is
invoked, we've overwritten the unborn HEAD).

So for now let's just teach git-pull to handle this feature.

Reported-by: Felix Eckhofer <felix@eckhofer.com>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin/pull.c b/builtin/pull.c
index 681c127a07071c98641972227a28dbe7f77eaf70..96c795f581aab8724d8c95ab847ecdcdd528684b 100644 (file)
--- a/builtin/pull.c
+++ b/builtin/pull.c
@@ -556,6 +556,17 @@ static int run_fetch(const char *repo, const char **refspecs)
 static int pull_into_void(const struct object_id *merge_head,
                const struct object_id *curr_head)
 {
 static int pull_into_void(const struct object_id *merge_head,
                const struct object_id *curr_head)
 {

+       if (opt_verify_signatures) {
+               struct commit *commit;
+
+               commit = lookup_commit(the_repository, merge_head);
+               if (!commit)
+                       die(_("unable to access commit %s"),
+                           oid_to_hex(merge_head));
+
+               verify_merge_signature(commit, opt_verbosity);
+       }
+

        /*
         * Two-way merge: we treat the index as based on an empty tree,
         * and try to fast-forward to HEAD. This ensures we will not lose
        /*
         * Two-way merge: we treat the index as based on an empty tree,
         * and try to fast-forward to HEAD. This ensures we will not lose

diff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh
index 747775c147612f3b09a599661fe3dc7d3b1d34bd..3e9876e1971348daad7fd87f8aa107ea5fd6aaff 100755 (executable)
--- a/t/t5573-pull-verify-signatures.sh
+++ b/t/t5573-pull-verify-signatures.sh
@@ -78,4 +78,11 @@ test_expect_success GPG 'pull commit with bad signature with --no-verify-signatu
        git pull --ff-only --no-verify-signatures bad 2>pullerror
 '
 
        git pull --ff-only --no-verify-signatures bad 2>pullerror
 '
 

+test_expect_success GPG 'pull unsigned commit into unborn branch' '
+       git init empty-repo &&
+       test_must_fail \
+               git -C empty-repo pull --verify-signatures ..  2>pullerror &&
+       test_i18ngrep "does not have a GPG signature" pullerror
+'
+

 test_done
 test_done