Aman-Mittal commented on code in PR #392:
URL:
https://github.com/apache/fineract-backoffice-ui/pull/392#discussion_r3836669401
##########
scripts/verify-signed-commits.sh:
##########
@@ -63,26 +63,41 @@ fi
UNSIGNED_COUNT=0
-# ponytail: only %G? == N (no signature) fails. A runner has no contributor
public
-# keys, so E/U/B would flag every signed commit as broken — GitHub's own
-# verification covers key validity.
+# A commit is signed when git reports any %G? other than N, OR when the object
+# carries a gpgsig / gpgsig-sha256 header. The second check is required for SSH
+# signatures: GitHub Actions runners have no gpg.ssh.allowedSignersFile, and
git
+# then reports SSH-signed commits as N even though the payload is on the
object.
+# Validity of the key is GitHub's job (Verified badge), not this script's.
+commit_has_signature_payload() {
Review Comment:
Why modify the GA check?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
