tag: add tag.gpgSign config option to force all tags be GPG-signed

As many CI/CD tools don't allow to control command line options when
executing `git tag` command, a default value in the configuration file
will allow to enforce tag signing if required.

The new config-file option tag.gpgSign is added to define default behavior
of tag signings. To override default behavior the command line option -s,
--sign and --no-sign can be used:

$ git tag -m "commit message"

will generate a GPG signed tag if tag.gpgSign option is true, while

$ git tag --no-sign -m "commit message"

will skip the signing step.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/Documentation/config/tag.txt b/Documentation/config/tag.txt
index 663663bdecfcbc9187432b07648abb31182520e3..ef5adb3f420df087132a15a9d0e825e911407758 100644 (file)
--- a/Documentation/config/tag.txt
+++ b/Documentation/config/tag.txt
@@ -8,6 +8,14 @@ tag.sort::
        linkgit:git-tag[1]. Without the "--sort=<value>" option provided, the
        value of this variable will be used as the default.
 
+tag.gpgSign::
+       A boolean to specify whether all tags should be GPG signed.
+       Use of this option when running in an automated script can
+       result in a large number of tags being signed. It is therefore
+       convenient to use an agent to avoid typing your gpg passphrase
+       several times. Note that this option doesn't affects tag signing
+       behavior enabled by "-u <keyid>" or "--local-user=<keyid>" options.
+
 tar.umask::
        This variable can be used to restrict the permission bits of
        tar archive entries.  The default is 0002, which turns off the

diff --git a/Documentation/git-tag.txt b/Documentation/git-tag.txt
index a74e7b926d030f6f385e49be68714133f6e3c06e..2e5599a67f86ad16969a5ea2697bdeb50ca801a6 100644 (file)
--- a/Documentation/git-tag.txt
+++ b/Documentation/git-tag.txt
@@ -64,6 +64,13 @@ OPTIONS
 -s::
 --sign::
        Make a GPG-signed tag, using the default e-mail address's key.
+       The default behavior of tag GPG-signing is controlled by `tag.gpgSign`
+       configuration variable if it exists, or disabled oder otherwise.
+       See linkgit:git-config[1].
+
+--no-sign::
+       Override `tag.gpgSign` configuration variable that is
+       set to force each and every tag to be signed.
 
 -u <keyid>::
 --local-user=<keyid>::

diff --git a/builtin/tag.c b/builtin/tag.c
index ef37dccf864932a31c019775cdad6d33207941a1..e0a4c25382846f801c43cd1093ffb0ffa63f975f 100644 (file)
--- a/builtin/tag.c
+++ b/builtin/tag.c
@@ -33,6 +33,7 @@ static const char * const git_tag_usage[] = {
 
 static unsigned int colopts;
 static int force_sign_annotate;
+static int config_sign_tag = -1; /* unspecified */
 
 static int list_tags(struct ref_filter *filter, struct ref_sorting *sorting,
                     struct ref_format *format)
@@ -144,6 +145,11 @@ static int git_tag_config(const char *var, const char *value, void *cb)
        int status;
        struct ref_sorting **sorting_tail = (struct ref_sorting **)cb;
 
+       if (!strcmp(var, "tag.gpgsign")) {
+               config_sign_tag = git_config_bool(var, value);
+               return 0;
+       }
+
        if (!strcmp(var, "tag.sort")) {
                if (!value)
                        return config_error_nonbool(var);
@@ -442,15 +448,10 @@ int cmd_tag(int argc, const char **argv, const char *prefix)
        memset(&opt, 0, sizeof(opt));
        memset(&filter, 0, sizeof(filter));
        filter.lines = -1;
+       opt.sign = -1;
 
        argc = parse_options(argc, argv, prefix, options, git_tag_usage, 0);
 
-       if (keyid) {
-               opt.sign = 1;
-               set_signing_key(keyid);
-       }
-       create_tag_object = (opt.sign || annotate || msg.given || msgfile);
-
        if (!cmdmode) {
                if (argc == 0)
                        cmdmode = 'l';
@@ -463,6 +464,15 @@ int cmd_tag(int argc, const char **argv, const char *prefix)
        if (cmdmode == 'l')
                setup_auto_pager("tag", 1);
 
+       if (opt.sign == -1)
+               opt.sign = cmdmode ? 0 : config_sign_tag > 0;
+
+       if (keyid) {
+               opt.sign = 1;
+               set_signing_key(keyid);
+       }
+       create_tag_object = (opt.sign || annotate || msg.given || msgfile);
+
        if ((create_tag_object || force) && (cmdmode != 0))
                usage_with_options(git_tag_usage, options);
 

diff --git a/t/t7004-tag.sh b/t/t7004-tag.sh
index 6aeeb279a0a03614151a37f1bed8f22f4af0c4f5..80eb13d94e2a27d160424c9919ee0052c8c773c0 100755 (executable)
--- a/t/t7004-tag.sh
+++ b/t/t7004-tag.sh
@@ -932,6 +932,27 @@ test_expect_success GPG \
        test_cmp expect actual
 '
 
+get_tag_header gpgsign-enabled $commit commit $time >expect
+echo "A message" >>expect
+echo '-----BEGIN PGP SIGNATURE-----' >>expect
+test_expect_success GPG \
+       'git tag configured tag.gpgsign enables GPG sign' \
+       'test_config tag.gpgsign true &&
+       git tag -m "A message" gpgsign-enabled &&
+       get_tag_msg gpgsign-enabled>actual &&
+       test_cmp expect actual
+'
+
+get_tag_header no-sign $commit commit $time >expect
+echo "A message" >>expect
+test_expect_success GPG \
+       'git tag --no-sign configured tag.gpgsign skip GPG sign' \
+       'test_config tag.gpgsign true &&
+       git tag -a --no-sign -m "A message" no-sign &&
+       get_tag_msg no-sign>actual &&
+       test_cmp expect actual
+'
+
 test_expect_success GPG \
        'trying to create a signed tag with non-existing -F file should fail' '
        ! test -f nonexistingfile &&