use git verify-commit

Use git verify-commit to verify gpg signatures, rather than the old method
of parsing git log output.

These two methods should always have the same result. Note that
git verify-commit allows signatures with unknown validity, the same as
git log's "U" output which was accepted. So any key in the gpg keyring
is allowed to sign the commit. Propellor provides gpg with a keyring
containing only the allowed keys.

Needs git 2.0, which is in even debian oldstable.

This commit was sponsored by Ewen McNeill on Patreon.

1 files changed, 4 insertions, 5 deletions

diff --git a/src/Propellor/Git/VerifiedBranch.hs b/src/Propellor/Git/VerifiedBranch.hs
index df607bd2..e56379f4 100644
--- a/src/Propellor/Git/VerifiedBranch.hs
+++ b/src/Propellor/Git/VerifiedBranch.hs
@@ -6,9 +6,8 @@ import Propellor.PrivData.Paths
 import Utility.FileMode
 
 {- To verify origin branch commit's signature, have to convince gpg
- - to use our keyring.
- - While running git log. Which has no way to pass options to gpg.
- - Argh!
+ - to use our keyring while running git verify-tag.
+ - Which has no way to pass options to gpg. Argh!
  -}
 verifyOriginBranch :: String -> IO Bool
 verifyOriginBranch originbranch = do
@@ -20,12 +19,12 @@ verifyOriginBranch originbranch = do
 		]
 	-- gpg is picky about perms
 	modifyFileMode privDataDir (removeModes otherGroupModes)
-	s <- readProcessEnv "git" ["log", "-n", "1", "--format=%G?", originbranch]
+	verified <- boolSystemEnv "git" ["verify-commit", originbranch]
 		(Just [("GNUPGHOME", privDataDir)])
 	nukeFile $ privDataDir </> "trustdb.gpg"
 	nukeFile $ privDataDir </> "pubring.gpg"
 	nukeFile $ privDataDir </> "gpg.conf"
-	return (s == "U\n" || s == "G\n")
+	return verified
 
 -- Returns True if HEAD is changed by fetching and merging from origin.
 fetchOrigin :: IO Bool