|
Use git verify-commit to verify gpg signatures, rather than the old method
of parsing git log output.
These two methods should always have the same result. Note that
git verify-commit allows signatures with unknown validity, the same as
git log's "U" output which was accepted. So any key in the gpg keyring
is allowed to sign the commit. Propellor provides gpg with a keyring
containing only the allowed keys.
Needs git 2.0, which is in even debian oldstable.
This commit was sponsored by Ewen McNeill on Patreon.
|