Re: [PATCH v8 3/5] merge/pull: verify GPG signatures of commits being merged

2013-04-01 Thread Junio C Hamano
Sebastian Götte writes: > On 04/01/2013 04:47 AM, Junio C Hamano wrote: >> I'll squash in something like the following and push out the result >> on 'pu' tonight. Please check to see if I made silly mistakes while >> doing so. >> >> Thanks. >> >... > Looks fine to me. Thanks for a quick respo

Re: [PATCH v8 3/5] merge/pull: verify GPG signatures of commits being merged

2013-04-01 Thread Sebastian Götte
On 04/01/2013 04:47 AM, Junio C Hamano wrote: > I'll squash in something like the following and push out the result > on 'pu' tonight. Please check to see if I made silly mistakes while > doing so. > > Thanks. > > builtin/merge.c | 18 ++ > 1 file changed, 10 insertions(+), 8 de

Re: [PATCH v8 3/5] merge/pull: verify GPG signatures of commits being merged

2013-03-31 Thread Junio C Hamano
Sebastian Götte writes: > + if (verify_signatures) { > + for (p = remoteheads; p; p = p->next) { > + struct commit *commit = p->item; > + char hex[41]; > + struct signature_check signature_check; > + m

[PATCH v8 3/5] merge/pull: verify GPG signatures of commits being merged

2013-03-31 Thread Sebastian Götte
When --verify-signatures is specified on the command-line of git-merge or git-pull, check whether the commits being merged have good gpg signatures and abort the merge in case they do not. This allows e.g. auto-deployment from untrusted repo hosts. Signed-off-by: Sebastian Götte --- Documentatio