20 lines
967 B
Bash
Executable File
20 lines
967 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Verify every commit in a release range has a cryptographically good Git
|
|
# signature. This is deliberately strict for release/main enforcement: unsigned
|
|
# or merely unknown signatures cannot become production provenance.
|
|
# Usage: verify-signed-commits.sh [range] (default: HEAD)
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
ROOT="$CASAN_APP_ROOT"; RANGE="${1:-HEAD}"
|
|
commits=()
|
|
while IFS= read -r commit; do [[ -n "$commit" ]] && commits+=("$commit"); done < <(git -C "$ROOT" rev-list --reverse "$RANGE")
|
|
[[ "${#commits[@]}" -gt 0 ]] || { echo "SIGNED_COMMITS_FAIL empty_range=$RANGE" >&2; exit 1; }
|
|
for commit in "${commits[@]}"; do
|
|
status="$(git -C "$ROOT" log -1 --format='%G?' "$commit")"
|
|
[[ "$status" == G ]] || { echo "SIGNED_COMMITS_FAIL commit=$commit signature_status=$status" >&2; exit 1; }
|
|
done
|
|
echo "SIGNED_COMMITS_VERIFIED range=$RANGE count=${#commits[@]}"
|