Merge pull request #29 from terrastruct/fix-signature-check-with-ssh

setup empty allowed signers to check ssh signature status

.gitignore

@@ -1 +1,2 @@
 .changed-files
+.emptyAllowedSigners

lib.sh

@@ -335,7 +335,8 @@ ensure_signed() {
     return
   fi
 
-  # look for signature status N: no signature
+  setup_allowed_signers
+  # look for signature status N: no signature (verification done by github)
   if [ ! "$(git log --format="%G?" ${GIT_BASE:+"$GIT_BASE..HEAD"} | grep "N")" ]; then
     return
   fi
@@ -344,6 +345,17 @@ ensure_signed() {
   return 1
 }
 
+setup_allowed_signers() {
+  # we only care if a signature is present (github will verify) so we don't need any entries,
+  # but "gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification"
+  if git config --get gpg.ssh.allowedSignersFile >/dev/null; then
+    return
+  fi
+  allowed_signers=".emptyAllowedSigners"
+  touch $allowed_signers
+  git config --local gpg.ssh.allowedSignersFile "$allowed_signers"
+}
+
 git_commit_count() {
   # macOS sh is buggy and requires the subshell here.
   (git rev-list HEAD --count 2>/dev/null) || echo 0

lib/git.sh

@@ -177,7 +177,8 @@ ensure_signed() {
     return
   fi
 
-  # look for signature status N: no signature
+  setup_allowed_signers
+  # look for signature status N: no signature (verification done by github)
   if [ ! "$(git log --format="%G?" ${GIT_BASE:+"$GIT_BASE..HEAD"} | grep "N")" ]; then
     return
   fi
@@ -186,6 +187,17 @@ ensure_signed() {
   return 1
 }
 
+setup_allowed_signers() {
+  # we only care if a signature is present (github will verify) so we don't need any entries,
+  # but "gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification"
+  if git config --get gpg.ssh.allowedSignersFile >/dev/null; then
+    return
+  fi
+  allowed_signers=".emptyAllowedSigners"
+  touch $allowed_signers
+  git config --local gpg.ssh.allowedSignersFile "$allowed_signers"
+}
+
 git_commit_count() {
   # macOS sh is buggy and requires the subshell here.
   (git rev-list HEAD --count 2>/dev/null) || echo 0