98 lines
2.9 KiB
Bash
Executable File
98 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# Usage: ./scripts/verify-signed-commits.sh [--base-ref <ref>] [--head-ref <ref>] [--strict] [--help]
|
|
set -e
|
|
|
|
BASE_REF="origin/develop"
|
|
HEAD_REF="HEAD"
|
|
STRICT_MODE=false
|
|
|
|
show_help() {
|
|
cat << 'EOF'
|
|
Usage: ./scripts/verify-signed-commits.sh [OPTIONS]
|
|
|
|
Options:
|
|
--base-ref <ref> Base reference (default: origin/develop)
|
|
--head-ref <ref> Head reference (default: HEAD)
|
|
--strict Exit with error if unsigned commits found
|
|
--help Show this help
|
|
EOF
|
|
}
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
--base-ref) BASE_REF="$2"; shift 2 ;;
|
|
--head-ref) HEAD_REF="$2"; shift 2 ;;
|
|
--strict) STRICT_MODE=true; shift ;;
|
|
--help) show_help; exit 0 ;;
|
|
*) echo "Unknown option: $1"; show_help; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
MERGE_BASE=$(git merge-base "$BASE_REF" "$HEAD_REF" 2>/dev/null || echo "")
|
|
if [ -z "$MERGE_BASE" ]; then
|
|
COMMIT_RANGE="$HEAD_REF~10..$HEAD_REF"
|
|
else
|
|
COMMIT_RANGE="$MERGE_BASE..$HEAD_REF"
|
|
fi
|
|
|
|
echo "Verifying commit signatures in range: $COMMIT_RANGE"
|
|
|
|
COMMITS=$(git log --format="%H%x1f%G?%x1f%an%x1f%s" "$COMMIT_RANGE" 2>/dev/null || echo "")
|
|
if [ -z "$COMMITS" ]; then
|
|
echo "No commits to verify."
|
|
exit 0
|
|
fi
|
|
|
|
UNSIGNED_COUNT=0
|
|
|
|
while IFS=$'\x1f' read -r HASH SIG_STATUS AUTHOR SUBJECT; do
|
|
[ -z "$HASH" ] && continue
|
|
SHORT_HASH="${HASH:0:7}"
|
|
|
|
case "$SIG_STATUS" in
|
|
N)
|
|
UNSIGNED_COUNT=$((UNSIGNED_COUNT + 1))
|
|
if [ -n "$GITHUB_ACTIONS" ]; then
|
|
echo "::error title=Unsigned Commit::Commit $SHORT_HASH by $AUTHOR is not signed."
|
|
else
|
|
echo "❌ Unsigned: $SHORT_HASH - $SUBJECT ($AUTHOR)"
|
|
fi
|
|
;;
|
|
*)
|
|
echo "✅ Signed: $SHORT_HASH - $SUBJECT"
|
|
;;
|
|
esac
|
|
done <<< "$COMMITS"
|
|
|
|
echo ""
|
|
echo "Summary: $UNSIGNED_COUNT unsigned commit(s) found."
|
|
|
|
if [ "$STRICT_MODE" = true ] && [ "$UNSIGNED_COUNT" -gt 0 ]; then
|
|
if [ -n "$GITHUB_ACTIONS" ]; then
|
|
echo "::error::$UNSIGNED_COUNT unsigned commit(s). See CONTRIBUTING.md#signing-your-commits"
|
|
else
|
|
echo "❌ $UNSIGNED_COUNT unsigned commit(s). See CONTRIBUTING.md#signing-your-commits"
|
|
fi
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|