You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We are using a [Python package](https://github.com/PyGithub/PyGithub) which is a wrapper for the GitHub REST API.
87
87
88
-
The only way to get the data is by using its SHA and we do not have the filename store anywhere yet. The way git stores the filename is by using another object in the database: the `tree`. The simplest `tree` object only contains a reference to one `blob` object. The `tree` is like a directory with the list of files where the contents of the files are the `blob` objects. We need to create a dir (`tree`) also for only one file because Git will add the file metadata there. The same object is used for one an multiple files. The `tree` can also contains another `tree`.
88
+
The only way to get the data is by using its SHA and we do not have the filename store anywhere yet. The way git stores the filename is by using another object in the database: the `tree`. The simplest `tree` object only contains a reference to one `blob` object. The `tree` is like a directory with the list of files where the contents of the files are the `blob` objects. We need to create a dir (`tree`) also for only one file because Git will add the file metadata there. The same object is used for one an multiple files. The `tree` can also contain another `tree`.
89
89
90
90
In order to create the `tree`, we need to take the state of the staging area. You first have to set up an index by staging some files with these commands:
In those documents, they promote the use of the master or primary key. Or at least if what they use. They probably do not want to overwhelm the reader with a lot of GPG technical stuff.
10
+
In those documents, they promote the use of the master or primary key. Or at least, it's what they use. They probably do not want to overwhelm the reader with a lot of GPG technical stuff.
11
11
12
12
If you list one of your GPG keys you will see something like:
13
13
@@ -31,7 +31,7 @@ The meaning for the letters inside brackets are the [GPG key capabilities](https
31
31
| E | Encrypt |
32
32
| A | Authentication |
33
33
34
-
If you want to create a signing key you can follow Debian's post. In my case for the key I'm using in all the examples, this was the output:
34
+
If you want to create a signing key, you can follow [Debian's post](https://wiki.debian.org/Subkeys). In my case for the key I'm using in all the examples, this was the output:
@@ -112,9 +112,9 @@ Then, you can replace your git config:
112
112
signingkey = B29BA7899D6062BE
113
113
```
114
114
115
-
You need to upload agan the public key to GitHub in order to import also the subkey, otherwise you new commits using the the subkey will be shown as unverified.
115
+
You need to upload again the public key to GitHub to import also the subkey, otherwise you new commits using the subkey will be shown as unverified.
116
116
117
-
TODO: then you should remove all the capabilities from the primary key expcet for "Certify" ([C]).
117
+
TODO: you should remove all the capabilities from the primary key except for "Certify" ([C]).
Copy file name to clipboardexpand all lines: docs/how_to_sign_commits_using_the_gitpython_package.md
+17-17
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
> [GitPython](https://github.com/gitpython-developers/GitPython) is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.
4
4
5
-
GitPython does not allow you to sign commits with its `git-porcelain` method. The way you can committ with GitPython is:
5
+
GitPython does not allow you to sign commits with its `git-porcelain` method. The way you can commit with GitPython is:
6
6
7
7
```python
8
8
repo = Repo(repo_dir)
@@ -32,19 +32,19 @@ index.write()
32
32
repo.git.commit(arg, ...)
33
33
```
34
34
35
-
I do not not exactly why you need to `write` your changes but it something the git commit wrapper does:
35
+
I do not know exactly why you need to `write` your changes but it is something the git commit wrapper does:
And it's something [Sebastian Thiel](https://github.com/gitpython-developers/GitPython/issues/580#issuecomment-282474086) said it was needed.
39
+
And it's something [Sebastian Thiel](https://github.com/gitpython-developers/GitPython/issues/580#issuecomment-282474086) said it is needed.
40
40
41
-
So if you want to sign the commit you only have to specify the signing key. The GitPython package relies on Git configuration and Git relies on GPG configuration. What is happending under the hood is:
41
+
So if you want to sign the commit, you only have to specify the signing key. The GitPython package relies on Git configuration, and Git relies on GPG configuration. What is happening under the hood is:
42
42
43
43
1. GitPython is going to call the git commit command using a [git binary wrapper](https://github.com/gitpython-developers/GitPython/blob/254305c935893d7578b112acfa814a07d398ae28/git/cmd.py#L171).
44
44
2. Git is going to call GPG command to sign the commit.
45
45
3. GPG is going to prompt you with the passphrase of the key.
46
46
47
-
As long as the GPG and Git configuration are OK, GitPython will sign the commit correctly. The [example 03](../03_sign_commit_using_the_gitpython_package) in this repo creates a new signed commit, but before signing, it also sets up the GPG and Git configuration needed. I'm not going to explain how you can create a GPG key and sign commits manually becuase you can follow other tutorials like:
47
+
As long as the GPG and Git configuration are OK, GitPython will sign the commit correctly. The [example 03](../03_sign_commit_using_the_gitpython_package) in this repo creates a newly signed commit, but before signing, it also sets up the GPG and Git configuration needed. In case you want to know how you can sign commits manually, you can follow other tutorials like:
48
48
49
49
-[Git Documentation - Git Tools - Signing Your Work](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work)
The code it's very simple. For this example I'm passing both the private key and passphrase as environment variables. I'm using docker for the example and docker `.env` file for passing env vars. But since docker does not allow to use multi-line string values for variables, I had to store the privete key as a one-line string and then convert it back to the standard multi-line version. That means the `gpg_private_key` variable contains something like:
104
+
The code is very simple. For this example, I'm passing both the private key and passphrase as environment variables. I'm using docker for the example and docker `.env` file for passing env vars. But since docker does not allow to use multi-line string values for variables, I had to store the private key as a one-line string and then convert it back to the standard multi-line version. That means the `gpg_private_key` variable contains something like:
You also have to provide the `passphrase` which will be use to encript the private key. The method returns the finrgerprint of the imported keys and the number of keys imported. In the example`import_result.fingerprints` contains this array:
112
+
You also have to provide the `passphrase` which will be used to encrypt the private key. The method returns the fingerprint of the imported keys and the number of keys imported. The variable`import_result.fingerprints` contains this array:
I do not know why the primary key ID is duplicated. Maybe it's a bug an it should return the fingerprint of the subkey (`97D36F5B8F5BECDA8A1923FC00D11C7C438584F9`). Anyway, for this exmaple I'm going to use the primary key which is not a good practice, althouth Git and GitHub tutorials also use it. Please read the links below to know why it is not considered a good practice.
118
+
I do not know why the primary key ID is duplicated. Maybe it's a bug, and it should return the fingerprint of the subkey (`97D36F5B8F5BECDA8A1923FC00D11C7C438584F9`). Anyway, for this example, I'm going to use the primary key, which is not a good practice, although Git and GitHub tutorials also use it. Please read the links below to know why it is not considered a good practice.
119
119
120
-
At this point, we have the key imported in our keyring but GPG it's going to ask us for the passphrase every time we sign something. The next section explain why you can avoid that.
120
+
At this point, we have the key imported in our keyring but GPG it's going to ask us for the passphrase every time we sign something. The next section explains why you can avoid that.
We need to use the same author name and email that we have on the GPG key. Althougth the `gnupg` has some methods to get that information, I did it parsing again the output of the same command I used to get the keygrip of the key.
179
+
We need to use the same author name and email that we have on the GPG key. Although the `gnupg` has some methods to get that information, I did it by parsing the output of the same gpg command again.
180
180
181
181
## Future improvements
182
182
183
-
Te action shows some warnings:
183
+
The action shows some warnings:
184
184
185
185
```text
186
186
gpg: WARNING: unsafe permissions on homedir '/root/.gnupg'
@@ -200,9 +200,9 @@ By the way, the GitHub Action I'm using in the workflows to import GPG keys also
200
200
201
201
## Acknowledges
202
202
203
-
Thanks to all the contributors all the [Import GPG GitHub Action](https://github.com/marketplace/actions/import-gpg). It would have taken me much more time to find the solution whithout following their Typescript solution.
203
+
Thanks to all the contributors of the [Import GPG GitHub Action](https://github.com/marketplace/actions/import-gpg). It would have taken me much more time to find the solution whithout following their Typescript solution.
204
204
205
-
And also to [Sebastian Thiel](https://github.com/Byron) who is one of the maintainer of the [GitPython](https://github.com/gitpython-developers/GitPython) package and who [pointed me and other people to the right solution](https://github.com/gitpython-developers/GitPython/issues/580#issuecomment-282473867).
205
+
And also to [Sebastian Thiel](https://github.com/Byron) who is one of the maintainers of the [GitPython](https://github.com/gitpython-developers/GitPython) package and who [pointed me and others to the right solution](https://github.com/gitpython-developers/GitPython/issues/580#issuecomment-282473867).
0 commit comments