opensource-joe commented on PR #339:
URL:
https://github.com/apache/fineract-backoffice-ui/pull/339#issuecomment-5297838432
@Aman-Mittal Amended. The Claude co-author trailer is gone from this branch
and from #338, and both commits are now GPG signed. The trees are
byte-identical to before, so this is a message and signature change only.
On the check itself, one thing worth flagging because it will hit every SSH
signer and not just me.
`scripts/verify-signed-commits.sh` fails only on `%G?` == `N`, and the
comment inside it is explicit that `E`/`U`/`B` should pass, since a runner
holds no contributor public keys. That reasoning is right for GPG. It does not
hold for SSH: when `gpg.ssh.allowedSignersFile` is unset, git cannot begin
verification at all, so it reports `N` rather than `E`. The previous commit
here was SSH signed, which is why it read as unsigned:
```
$ git log --format='%G?' -1 a0430d0 # locally,
allowed_signers configured
G
$ GIT_CONFIG_GLOBAL=/dev/null git log --format='%G?' -1 a0430d0 # what the
runner sees
error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh
signature verification
N
```
Two ways to close the gap if you want it closed, both tested locally:
1. Point the workflow at an empty allowed-signers file, which turns `N` into
`U` for SSH and the script already passes `U`:
`git -c gpg.ssh.allowedSignersFile=/tmp/empty log --format='%G?' -1
<sha>` returns `U`.
2. Or test for the signature header directly, which is what the script's
comment intends and which covers both formats: `git cat-file commit <sha> |
grep -q '^gpgsig'`. That returns 1 for a signed commit and 0 for an unsigned
one.
CONTRIBUTING.md does say GPG specifically, so I have moved to GPG here
either way and am not asking for the check to change on my account. Happy to
send the fix as its own PR if it is wanted, though I did not want to touch
#337's work uninvited.
Two practical notes:
- The four workflows on the new head are at `action_required` and need an
approval before they re-run.
- GitHub is showing these commits as Unverified with `reason: unknown_key`,
because my GPG public key is not registered on my account yet. I am fixing that
separately. It affects GitHub's badge only, not this repo's check, which passes
on any signature that is present.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
