结果如下 (你本机的哈希结果可能不同): $ git log --oneline --graph * 9307dc5 Merge branch 'diverge' |\ | * 996cf32 Added additional content to diverged | * cfe7389 Added content to diverged * | 3cbc6d2 Added data to master |/ * f729243 Yet another foo * afb1e73 Modified bar * f227c90 Added bar * 652f9ae Signed off * 16ddd46 Added feature X * cf43808 Test commit of foo 从上图中可以看出，只有两处需要签名: 3cbc6d2, 在master直接创建, 9307dc5---合并提交后生成. 另外两处提交 (996cf32 和 cfe7389) 不需要签名，在合并时就确保了其有效性 (假设提交者是谨慎的). 但怎么忽略这些提交呢? $ git log --oneline --graph --first-parent * 9307dc5 Merge branch 'diverge' * 3cbc6d2 Added data to master * f729243 Yet another foo * afb1e73 Modified bar * f227c90 Added bar * 652f9ae Signed off * 16ddd46 Added feature X * cf43808 Test commit of foo 上述例子简单的添加了 --first-parent选项, 这样在遇到有合并提交时只会显示最初的提交记录. 重点就是, 这就只剩下master上的提交记录 (或是你需要参照的分支).这些是需要验证的. 现在的验证工作仅仅需要微调原来的脚本即可: #!/bin/sh## Validate signatures on only direct commits and merge commits for a particular# branch (current branch)### if a ref is provided, append range spec to include all childrenchkafter="${1+$1..}"# note: bash users may instead use $'\t'; the echo statement below is a more# portable option (-e is unsupported with /bin/sh)t=$( echo '\t' )# Check every commit after chkafter (or all commits if chkafter was not# provided) for a trusted signature, listing invalid commits. %G? will output# "G" if the signature is trusted.git log --pretty="format:%H$t%aN$t%s$t%G?" "${chkafter:-HEAD}" --first-parent \
| grep -v "${t}G$"# grep will exit with a non-zero status if no matches are found, which we# consider a success, so invert it[ $? -gt 0 ]如果你在刚建好的分支上运行上述脚本, 你会发现分支中不会包含相应的历史提交记录.由于合并提交的自带标记，结果中也不会显示相应的记录(剩下的就是那些未做标记的提交记录).要展示未标记的合并提交, 可以使用以下命令 (忽略 -S选项): $ git commit --amend[master 9ee66e9] Merge branch 'diverge'$ ./signchk 9ee66e900265d82f5389e403a894e8d06830e463 Mike Gerwitz Merge branch 'diverge'f72924356896ab95a542c495b796555d016cbddd Mike Gerwitz Yet another foo $ echo $?1 合并提交将被列出来，需要签名验证. 总结
|
