royteeuwen opened a new pull request, #53: URL: https://github.com/apache/sling-org-apache-sling-committer-cli/pull/53
JGit reads `commit.gpgsign` from the ambient git config, but only jgit core is on the classpath and it registers no `SignerFactory` (`Signers` is populated purely from `ServiceLoader.load(SignerFactory.class)`, and the core jar ships no `META-INF/services` entry at all). Any committer who signs their commits therefore hits `UnsupportedSigningFormatException` in all five places the tool commits — 28 errors across `JBakeContentUpdaterTest`, `UpdateLocalSiteCommandTest`, `UpdateLocalSiteGitTest` and `UpdateNewsCommandTest`. It fails identically with `gpg.format = openpgp`. `UpdateNewsCommandTest` has no `commit()` of its own; it fails via the shared `SiteRepository` fixture. ## Why `setSign(false)` rather than registering a signer Signing is currently impossible, not merely unconfigured, so this cannot remove behaviour that works: - The published image has no git config anywhere JGit looks (`/etc/gitconfig`, `/root/.gitconfig`, `/root/.config/git/config`, `/root/.config/jgit/config`), no `GIT_*`/`XDG_*` env vars, and `run.sh` mounts no volumes — so the host `~/.gitconfig` never reaches the container. - No jar in the image registers a `SignerFactory`; `Signers.get(SSH)` and `Signers.get(OPENPGP)` both return `null`. The Bouncy Castle bundles are there for `PGPSignatureValidator` (verifying release signatures), not as a JGit signer. - There is no `git`, `gpg` or `ssh` binary in the image either. So the only reachable outcomes today are "unsigned commit" or "crash". This turns the second into the first. The commit object is byte-identical with and without the flag — same tree, same headers, same SHA, no `gpgsig`. This does mean the CLI will never sign website commits, which is now an explicit decision rather than an accident. Making signing actually work is possible but is a separate feature: it needs a signer bundle, an explicit `Signers.set(...)` (plain `ServiceLoader` will not see across bundles under Felix), config set on the repo rather than inherited, and mounted key material. Happy to file that if there is appetite — worth deciding first whether signed *website content* commits are wanted, since they are not release artifacts. ## Verification `mvn verify` with `gpg.format = ssh` + `commit.gpgsign = true` configured: 183 tests, 0 failures, 0 errors (was 28 errors). Also green with no signing configured. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
