ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-29 00:59:39 +09:00
Code Issues Projects Releases Wiki Activity

fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)

Browse Source 
Updating a branch by merge produced an unsigned commit even when merges
are configured to be signed. Update by rebase was unaffected.

`Update()` builds a fake reverse PR to switch head and base, and it has
no `Index`, so `pr.GetGitHeadRefName()` resolves `refs/pull/0/head`.
Since #36186 `SignMerge` looks that ref up in the base repository
instead of the temporary merge repo. That lookup fails. The caller
dropped the error, so `sign` stayed false.

Sync fork goes through the same fake-PR path.

Pass both sides of the merge to `SignMerge` as refs and evaluate them in
the temp repo, where `base` and `tracking` always exist.

Tests cover a signed and an unsigned update by merge.

Fixes #38066
Backport #38441
This commit is contained in:
Eyüp Can Akman
2026-07-17 11:05:05 +00:00
committed by GitHub
parent 895d848ff4
commit cfc9f4c685
5 changed files with 100 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asymkey/sign.go
+14 -10
View File
@@ -270,19 +270,21 @@ Loop:
return true, signingKey, sig, nil
}
// SignMerge determines if we should sign a PR merge commit to the base repository
func SignMerge(ctx context.Context, pr *issues_model.PullRequest, u *user_model.User, gitRepo *git.Repository) (bool, *git.SigningKey, *git.Signature, error) {
// SignMerge determines if we should sign a PR merge commit to the base repository.
// baseRef and headRef must resolve in gitRepo. Callers pass the temporary merge repo's own
// refs for an update by merge, whose fake reverse PR has no head ref in the base repository.
func SignMerge(ctx context.Context, pr *issues_model.PullRequest, u *user_model.User, gitRepo *git.Repository, baseRef, headRef string) (bool, *git.SigningKey, *git.Signature, error) {
if err := pr.LoadBaseRepo(ctx); err != nil {
log.Error("Unable to get Base Repo for pull request")
return false, nil, nil, err
}
repo := pr.BaseRepo
baseCommit, err := gitRepo.GetCommit(pr.BaseBranch)
baseCommit, err := gitRepo.GetCommit(baseRef)
if err != nil {
return false, nil, nil, err
}
headCommit, err := gitRepo.GetCommit(pr.GetGitHeadRefName())
headCommit, err := gitRepo.GetCommit(headRef)
if err != nil {
return false, nil, nil, err
}
@@ -338,7 +340,7 @@ Loop:
return false, nil, nil, &ErrWontSign{headSigned}
}
case commitsSigned:
verified, err := AllHeadCommitsVerified(ctx, pr, gitRepo)
verified, err := allCommitsVerified(ctx, baseCommit, headCommit)
if err != nil {
return false, nil, nil, err
}
@@ -361,11 +363,13 @@ func AllHeadCommitsVerified(ctx context.Context, pr *issues_model.PullRequest, g
if err != nil {
return false, err
}
mergeBaseCommit, err := gitrepo.MergeBase(ctx, pr.BaseRepo, baseCommit.ID.String(), headCommit.ID.String())
if err != nil {
return false, err
}
commitList, err := headCommit.CommitsBeforeUntil(git.RefNameFromCommit(mergeBaseCommit))
return allCommitsVerified(ctx, baseCommit, headCommit)
}
// allCommitsVerified checks the commits a merge would introduce, those reachable from
// headCommit but not from baseCommit. Both commits must come from the same repository.
func allCommitsVerified(ctx context.Context, baseCommit, headCommit *git.Commit) (bool, error) {
commitList, err := headCommit.CommitsBeforeUntil(baseCommit.ID.RefName())
if err != nil {
return false, err
}