internet/community.general
3
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2026-05-07 22:02:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only use git verify-tag when verifying annotated tags (#26414)

Browse Source 
* Only use `git verify-tag` when verifying annotated tags

The command `git verify-tag` only applies to annotated tags. When
verifying lightweight tags, which are more similar to non-moving
branches, one has to use `git verify-commit` instead.

Using ':' as a separator is appropriate since that is one of the
characters not allowed in a Git reference name.

See also https://www.kernel.org/pub/software/scm/git/docs/git-check-ref-format.html

* Improve testing of the Git module's gpg verification
This commit is contained in:
Andreas Olsson
2017-07-19 17:30:12 +02:00
committed by jctanner
parent 779d05aec4
commit 593297d7a2
5 changed files with 248 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
lib/ansible/modules/source_control/git.py
View File

@@ -590,15 +590,17 @@ def get_branches(git_path, module, dest):
return branches
def get_tags(git_path, module, dest):
def get_annotated_tags(git_path, module, dest):
tags = []
cmd = '%s tag' % (git_path,)
cmd = [git_path, 'for-each-ref', 'refs/tags/', '--format', '%(objecttype):%(refname:short)']
(rc, out, err) = module.run_command(cmd, cwd=dest)
if rc != 0:
module.fail_json(msg="Could not determine tag data - received %s" % out, stdout=out, stderr=err)
for line in to_native(out).split('\n'):
if line.strip():
tags.append(line.strip())
tagtype, tagname = line.strip().split(':')
if tagtype == 'tag':
tags.append(tagname)
return tags
@@ -887,7 +889,7 @@ def switch_version(git_path, module, dest, remote, version, verify_commit, depth
def verify_commit_sign(git_path, module, dest, version):
if version in get_tags(git_path, module, dest):
if version in get_annotated_tags(git_path, module, dest):
git_sub = "verify-tag"
else:
git_sub = "verify-commit"