search

Murmele / Gittyup

Understand your Git history!
https://murmele.github.io/Gittyup
MIT License
1.49k stars 110 forks source link

PGP / GPG commit signatures #221

Open ghost opened 2 years ago

ghost commented 2 years ago

I have configured the pgp keys but I don't know why signing doesn't work.

Murmele commented 2 years ago

Hi @Developer563 can you explain more?

exactly-one-kas commented 2 years ago

Signing commits currently isn't implemented in Gittyup, I'm changing this to a feature request

(libgit2 supports it via git_commit_create_with_signature, but we'll have to implement creating a signature ourself, probably using gpgme)

Akselmo commented 2 years ago

Hi, I'm interested in this feature and maybe could try my hand at implementing it.

However, could the feature at first be just the signing process itself? Users could create the keys/signatures with other tools.

exactly-one-kas commented 2 years ago

Yes, just the signing would work I'd say we simply require GPG to be installed and spawn gpg --detach-sign --armor --local-user <committer email> to create the signature

Akselmo commented 2 years ago

I was thinking a following plan:

But should the user be told somewhere that signing is enabled in the repository?

Also, should the user be able to toggle signing on and off for the repository? Although I think many people who actually need this feature have already it set it up.

exactly-one-kas commented 2 years ago

Sounds good Is commit.gpgsign the option to sign stuff? If so, putting that as a checkbox into the repository settings seems like a good idea Also, using the commiter's email should probably be a fallback if user.signingkey is unset

Akselmo commented 1 year ago

Hey just an update, im still interested working on the feature, i just havent had the time yet due to getting a new job and life is busy.

I will get on this ASAP, but if someone else has more time than I do, im not stopping you :)

exactly-one-kas commented 1 year ago

Don't worry, take your time Your life should take priority over volunteer work

Akselmo commented 1 year ago

git_commit_create_with_signature asks for const char *commit_content but the documentation doesn't mention what exactly is the content.

Is it git_commit_body?

bonswouar commented 1 year ago

Would love to see this feature implemented!

@Akselmo since it's been 13 days your might have your answer already But just in case, according to the tests in libgit2 this commit_content is basically the whole commit content, like :

tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\n\
parent 8496071c1b46c854b31185ea97743be6a8774479\n\
author Ben Burkert <ben@benburkert.com> 1358451456 -0800\n\
committer Ben Burkert <ben@benburkert.com> 1358451456 -0800\n\
magicsig magic word: pretty please\n\
\n\
a simple commit which works\n";

See https://github.com/libgit2/libgit2/blob/ac0f2245510f6c75db1b1e7af7ca01c15dec26bc/tests/libgit2/commit/write.c#L349

Akselmo commented 1 year ago

Would love to see this feature implemented!

@Akselmo since it's been 13 days your might have your answer already But just in case, according to the tests in libgit2 this commit_content is basically the whole commit content, like :

tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904\n\
parent 8496071c1b46c854b31185ea97743be6a8774479\n\
author Ben Burkert <ben@benburkert.com> 1358451456 -0800\n\
committer Ben Burkert <ben@benburkert.com> 1358451456 -0800\n\
magicsig magic word: pretty please\n\
\n\
a simple commit which works\n";

See https://github.com/libgit2/libgit2/blob/ac0f2245510f6c75db1b1e7af7ca01c15dec26bc/tests/libgit2/commit/write.c#L349

Thanks! I have not been working on this much due to being busy with Life:tm:, but I'll see if I can get some work done on this this weekend :)

Akselmo commented 1 year ago

Hm, I don't know where to place the git_commit_create_with_signature just to test it works at all.

I've tried to place it in Repository.cpp around line 629, but I'm not sure if this is the right place. Basically I'm lost in the codebase

Can anyone give me a proper walkthrough what happens when user presses the commit button? I can't get debugger working with this either, GDB just crashes. Also I had no luck trying to find the commit button signals(?) from code either.

(I dont know if this is bit too difficult for me after all..)

bonswouar commented 1 year ago

I've tried to place it in Repository.cpp around line 629, but I'm not sure if this is the right place. Basically I'm lost in the codebase

@Akselmo I didn't dig much into the code but it seems you're on the right track, not sure if you've got access to everything for reconstructing the raw commit data from here though, you might need to create a new method with other parameters.

Unfortunately I haven't done any cpp for years and I don't know this project at all so I won't be able to help you much more :/

exactly-one-kas commented 1 year ago

@Akselmo Repository::commit() would be the right place, you can create another parameter that hands in the signature or the private key

OdinVex commented 1 year ago

For now, you can Edit Config and add:

[commit]
    gpgSign = true
[push]
    gpgSign = true
[tag]
    gpgSign = true

Talking about this (and commit messages) in #121 because it is so similar.

Edit: I've made a Pull Request (#405) to add these features. I don't know if we'll need to put up some UI icons (locks or checkmarks?) to show 'verified' signed stuff, would be nice. I don't recall if Gittyup does that currently.

Akselmo commented 1 year ago

Once again I apologize for my slowness. :sweat_smile: Just wanted to say I haven't forgotten this.

Also, I am not against it if someone else can implement the solution before me.

exactly-one-kas commented 1 year ago

Don't worry - you're doing this for free and are free to take whatever time you want

OdinVex commented 1 year ago

I think I should clarify my post above, this works with an installed Gittyup (non-Flatpak, I have not tested Flatpak versions) as it uses my global git that has my GPG signing key in it and all. This might not be the expected behavior of Gittyup and may not be a solution if so.

Edit: I forgot that last year I modified Gittyup to remove code that worked with commits to use my installation's git instead, to specifically support signoff and GPG because libgit2 does support git_commit_create_with_signature, but that is required to be implemented via the software. I implemented it using host git. It was a hackish work-around I forgot about. It works, but I don't think Gittyup wants to use local git installations...even though that would bring 'your installed version of git' support. Sorry I got everyone's hopes up on that. My solution isn't a publicly-shippable one.

Akselmo commented 1 year ago

Hey, I have unassigned myself, since I don't really use Gittyup anymore (im trying to learn git commands :D ) and I wanted to make it clear that anyone who has interest and more time to work on this can go for it.

I may give this another try, but I hope my questions may help anyone else who will attempt this.

Sorry I couldn't make this contribution happen (for now at least!). Gittyup is great software and I hope to see it improve in future. :)

OdinVex commented 1 year ago

Hey, I have unassigned myself, since I don't really use Gittyup anymore (im trying to learn git commands :D ) and I wanted to make it clear that anyone who has interest and more time to work on this can go for it.

I may give this another try, but I hope my questions may help anyone else who will attempt this.

Sorry I couldn't make this contribution happen (for now at least!). Gittyup is great software and I hope to see it improve in future. :)

Yeah, it requires replacing the git backend with either shell-executed git or a different, more-featured library for git access. I had forgotten that I had essentially done that in my local clone of the repo (a number of versions old with cherry-picked updates). For now, I could suggest using git commit -S -s -m "Message" -m "Description" in a shell when committing.

Murmele commented 1 year ago

Hi, is it available in newer libgit2 versions? Currently I am working on updating the libgit2 version to make it upstream compatible again. https://github.com/Murmele/Gittyup/pull/153 Maybe you can check there

OdinVex commented 1 year ago

Hi, is it available in newer libgit2 versions? Currently I am working on updating the libgit2 version to make it upstream compatible again. #153 Maybe you can check there

Unfortunately, it is not available yet. Worse, it doesn't appear to be a priority.

ghost commented 1 year ago

I would also be interested in seeing this implemented. I like this project overall, but my org requires us to sign our commits, so unfortunately I can't use it until then.

rimas-kudelis commented 5 months ago

This was mentioned above in passing, but somehow only once.

It seems that GPGME library is the suggested way of using GPG from within other applications, not executing the gpg binary.

OdinVex commented 5 months ago

This was mentioned above in passing, but somehow only once.

It seems that GPGME library is the suggested way of using GPG from within other applications, not executing the gpg binary.

Both. Being able to call external binaries rather than built-in should have been a top priority from the start for many reasons. Bug finding, testing new binaries that don't have libraries, implementation comparison, environment restrictions, features...

RokeJulianLockhart commented 4 months ago

https://github.com/Murmele/Gittyup/issues/221#issue-1318373310

Is this a duplicate of https://github.com/Murmele/Gittyup/issues/121#issue-1185637221?