mirror/ git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-05-09 02:06:12 +02:00
Code
git/Documentation/pretty-formats.txt
Hans Jerry Illikainen 54887b4689 gpg-interface: add minTrustLevel as a configuration option 
Previously, signature verification for merge and pull operations checked
if the key had a trust-level of either TRUST_NEVER or TRUST_UNDEFINED in
verify_merge_signature().  If that was the case, the process die()d.

The other code paths that did signature verification relied entirely on
the return code from check_commit_signature().  And signatures made with
a good key, irregardless of its trust level, was considered valid by
check_commit_signature().

This difference in behavior might induce users to erroneously assume
that the trust level of a key in their keyring is always considered by
Git, even for operations where it is not (e.g. during a verify-commit or
verify-tag).

The way it worked was by gpg-interface.c storing the result from the
key/signature status *and* the lowest-two trust levels in the `result`
member of the signature_check structure (the last of these status lines
that were encountered got written to `result`).  These are documented in
GPG under the subsection `General status codes` and `Key related`,
respectively [1].

The GPG documentation says the following on the TRUST_ status codes [1]:

    """
    These are several similar status codes:

    - TRUST_UNDEFINED <error_token>
    - TRUST_NEVER     <error_token>
    - TRUST_MARGINAL  [0  [<validation_model>]]
    - TRUST_FULLY     [0  [<validation_model>]]
    - TRUST_ULTIMATE  [0  [<validation_model>]]

    For good signatures one of these status lines are emitted to
    indicate the validity of the key used to create the signature.
    The error token values are currently only emitted by gpgsm.
    """

My interpretation is that the trust level is conceptionally different
from the validity of the key and/or signature.  That seems to also have
been the assumption of the old code in check_signature() where a result
of 'G' (as in GOODSIG) and 'U' (as in TRUST_NEVER or TRUST_UNDEFINED)
were both considered a success.

The two cases where a result of 'U' had special meaning were in
verify_merge_signature() (where this caused git to die()) and in
format_commit_one() (where it affected the output of the %G? format
specifier).

I think it makes sense to refactor the processing of TRUST_ status lines
such that users can configure a minimum trust level that is enforced
globally, rather than have individual parts of git (e.g. merge) do it
themselves (except for a grace period with backward compatibility).

I also think it makes sense to not store the trust level in the same
struct member as the key/signature status.  While the presence of a
TRUST_ status code does imply that the signature is good (see the first
paragraph in the included snippet above), as far as I can tell, the
order of the status lines from GPG isn't well-defined; thus it would
seem plausible that the trust level could be overwritten with the
key/signature status if they were stored in the same member of the
signature_check structure.

This patch introduces a new configuration option: gpg.minTrustLevel.  It
consolidates trust-level verification to gpg-interface.c and adds a new
`trust_level` member to the signature_check structure.

Backward-compatibility is maintained by introducing a special case in
verify_merge_signature() such that if no user-configurable
gpg.minTrustLevel is set, then the old behavior of rejecting
TRUST_UNDEFINED and TRUST_NEVER is enforced.  If, on the other hand,
gpg.minTrustLevel is set, then that value overrides the old behavior.

Similarly, the %G? format specifier will continue show 'U' for
signatures made with a key that has a trust level of TRUST_UNDEFINED or
TRUST_NEVER, even though the 'U' character no longer exist in the
`result` member of the signature_check structure.  A new format
specifier, %GT, is also introduced for users that want to show all
possible trust levels for a signature.

Another approach would have been to simply drop the trust-level
requirement in verify_merge_signature().  This would also have made the
behavior consistent with other parts of git that perform signature
verification.  However, requiring a minimum trust level for signing keys
does seem to have a real-world use-case.  For example, the build system
used by the Qubes OS project currently parses the raw output from
verify-tag in order to assert a minimum trust level for keys used to
sign git tags [2].

[1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/doc/DETAILS;h=bd00006e933ac56719b1edd2478ecd79273eae72;hb=refs/heads/master
[2] 9674c1991d/scripts/verify-git-tag (L43)

Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-01-15 14:06:06 -08:00

316 lines
12 KiB
Plaintext
Raw Blame History

PRETTY FORMATS
--------------
If the commit is a merge, and if the pretty-format
is not 'oneline', 'email' or 'raw', an additional line is
inserted before the 'Author:' line. This line begins with
"Merge: " and the sha1s of ancestral commits are printed,
separated by spaces. Note that the listed commits may not
necessarily be the list of the *direct* parent commits if you
have limited your view of history: for example, if you are
only interested in changes related to a certain directory or
file.
There are several built-in formats, and you can define
additional formats by setting a pretty.<name>
config option to either another format name, or a
'format:' string, as described below (see
linkgit:git-config[1]). Here are the details of the
built-in formats:
* 'oneline'
<sha1> <title line>
+
This is designed to be as compact as possible.
* 'short'
commit <sha1>
Author: <author>
<title line>
* 'medium'
commit <sha1>
Author: <author>
Date: <author date>
<title line>
<full commit message>
* 'full'
commit <sha1>
Author: <author>
Commit: <committer>
<title line>
<full commit message>
* 'fuller'
commit <sha1>
Author: <author>
AuthorDate: <author date>
Commit: <committer>
CommitDate: <committer date>
<title line>
<full commit message>
* 'email'
From <sha1> <date>
From: <author>
Date: <author date>
Subject: [PATCH] <title line>
<full commit message>
* 'raw'
+
The 'raw' format shows the entire commit exactly as
stored in the commit object. Notably, the SHA-1s are
displayed in full, regardless of whether --abbrev or
--no-abbrev are used, and 'parents' information show the
true parent commits, without taking grafts or history
simplification into account. Note that this format affects the way
commits are displayed, but not the way the diff is shown e.g. with
`git log --raw`. To get full object names in a raw diff format,
use `--no-abbrev`.
* 'format:<string>'
+
The 'format:<string>' format allows you to specify which information
you want to show. It works a little bit like printf format,
with the notable exception that you get a newline with '%n'
instead of '\n'.
+
E.g, 'format:"The author of %h was %an, %ar%nThe title was >>%s<<%n"'
would show something like this:
+
-------
The author of fe6e0ee was Junio C Hamano, 23 hours ago
The title was >>t4119: test autocomputing -p<n> for traditional diff input.<<
-------
+
The placeholders are:
- Placeholders that expand to a single literal character:
'%n':: newline
'%%':: a raw '%'
'%x00':: print a byte from a hex code
- Placeholders that affect formatting of later placeholders:
'%Cred':: switch color to red
'%Cgreen':: switch color to green
'%Cblue':: switch color to blue
'%Creset':: reset color
'%C(...)':: color specification, as described under Values in the
"CONFIGURATION FILE" section of linkgit:git-config[1]. By
default, colors are shown only when enabled for log output
(by `color.diff`, `color.ui`, or `--color`, and respecting
the `auto` settings of the former if we are going to a
terminal). `%C(auto,...)` is accepted as a historical
synonym for the default (e.g., `%C(auto,red)`). Specifying
`%C(always,...)` will show the colors even when color is
not otherwise enabled (though consider just using
`--color=always` to enable color for the whole output,
including this format and anything else git might color).
`auto` alone (i.e. `%C(auto)`) will turn on auto coloring
on the next placeholders until the color is switched
again.
'%m':: left (`<`), right (`>`) or boundary (`-`) mark
'%w([<w>[,<i1>[,<i2>]]])':: switch line wrapping, like the -w option of
linkgit:git-shortlog[1].
'%<(<N>[,trunc|ltrunc|mtrunc])':: make the next placeholder take at
least N columns, padding spaces on
the right if necessary. Optionally
truncate at the beginning (ltrunc),
the middle (mtrunc) or the end
(trunc) if the output is longer than
N columns. Note that truncating
only works correctly with N >= 2.
'%<|(<N>)':: make the next placeholder take at least until Nth
columns, padding spaces on the right if necessary
'%>(<N>)', '%>|(<N>)':: similar to '%<(<N>)', '%<|(<N>)' respectively,
but padding spaces on the left
'%>>(<N>)', '%>>|(<N>)':: similar to '%>(<N>)', '%>|(<N>)'
respectively, except that if the next
placeholder takes more spaces than given and
there are spaces on its left, use those
spaces
'%><(<N>)', '%><|(<N>)':: similar to '%<(<N>)', '%<|(<N>)'
respectively, but padding both sides
(i.e. the text is centered)
- Placeholders that expand to information extracted from the commit:
'%H':: commit hash
'%h':: abbreviated commit hash
'%T':: tree hash
'%t':: abbreviated tree hash
'%P':: parent hashes
'%p':: abbreviated parent hashes
'%an':: author name
'%aN':: author name (respecting .mailmap, see linkgit:git-shortlog[1]
or linkgit:git-blame[1])
'%ae':: author email
'%aE':: author email (respecting .mailmap, see linkgit:git-shortlog[1]
or linkgit:git-blame[1])
'%al':: author email local-part (the part before the '@' sign)
'%aL':: author local-part (see '%al') respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%ad':: author date (format respects --date= option)
'%aD':: author date, RFC2822 style
'%ar':: author date, relative
'%at':: author date, UNIX timestamp
'%ai':: author date, ISO 8601-like format
'%aI':: author date, strict ISO 8601 format
'%cn':: committer name
'%cN':: committer name (respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%ce':: committer email
'%cE':: committer email (respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%cl':: author email local-part (the part before the '@' sign)
'%cL':: author local-part (see '%cl') respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%cd':: committer date (format respects --date= option)
'%cD':: committer date, RFC2822 style
'%cr':: committer date, relative
'%ct':: committer date, UNIX timestamp
'%ci':: committer date, ISO 8601-like format
'%cI':: committer date, strict ISO 8601 format
'%d':: ref names, like the --decorate option of linkgit:git-log[1]
'%D':: ref names without the " (", ")" wrapping.
'%S':: ref name given on the command line by which the commit was reached
(like `git log --source`), only works with `git log`
'%e':: encoding
'%s':: subject
'%f':: sanitized subject line, suitable for a filename
'%b':: body
'%B':: raw body (unwrapped subject and body)
ifndef::git-rev-list[]
'%N':: commit notes
endif::git-rev-list[]
'%GG':: raw verification message from GPG for a signed commit
'%G?':: show "G" for a good (valid) signature,
"B" for a bad signature,
"U" for a good signature with unknown validity,
"X" for a good signature that has expired,
"Y" for a good signature made by an expired key,
"R" for a good signature made by a revoked key,
"E" if the signature cannot be checked (e.g. missing key)
and "N" for no signature
'%GS':: show the name of the signer for a signed commit
'%GK':: show the key used to sign a signed commit
'%GF':: show the fingerprint of the key used to sign a signed commit
'%GP':: show the fingerprint of the primary key whose subkey was used
to sign a signed commit
'%GT':: show the trust level for the key used to sign a signed commit
'%gD':: reflog selector, e.g., `refs/stash@{1}` or `refs/stash@{2
minutes ago}`; the format follows the rules described for the
`-g` option. The portion before the `@` is the refname as
given on the command line (so `git log -g refs/heads/master`
would yield `refs/heads/master@{0}`).
'%gd':: shortened reflog selector; same as `%gD`, but the refname
portion is shortened for human readability (so
`refs/heads/master` becomes just `master`).
'%gn':: reflog identity name
'%gN':: reflog identity name (respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%ge':: reflog identity email
'%gE':: reflog identity email (respecting .mailmap, see
linkgit:git-shortlog[1] or linkgit:git-blame[1])
'%gs':: reflog subject
'%(trailers[:options])':: display the trailers of the body as
interpreted by
linkgit:git-interpret-trailers[1]. The
`trailers` string may be followed by a colon
and zero or more comma-separated options:
** 'key=<K>': only show trailers with specified key. Matching is done
case-insensitively and trailing colon is optional. If option is
given multiple times trailer lines matching any of the keys are
shown. This option automatically enables the `only` option so that
non-trailer lines in the trailer block are hidden. If that is not
desired it can be disabled with `only=false`. E.g.,
`%(trailers:key=Reviewed-by)` shows trailer lines with key
`Reviewed-by`.
** 'only[=val]': select whether non-trailer lines from the trailer
block should be included. The `only` keyword may optionally be
followed by an equal sign and one of `true`, `on`, `yes` to omit or
`false`, `off`, `no` to show the non-trailer lines. If option is
given without value it is enabled. If given multiple times the last
value is used.
** 'separator=<SEP>': specify a separator inserted between trailer
lines. When this option is not given each trailer line is
terminated with a line feed character. The string SEP may contain
the literal formatting codes described above. To use comma as
separator one must use `%x2C` as it would otherwise be parsed as
next option. If separator option is given multiple times only the
last one is used. E.g., `%(trailers:key=Ticket,separator=%x2C )`
shows all trailer lines whose key is "Ticket" separated by a comma
and a space.
** 'unfold[=val]': make it behave as if interpret-trailer's `--unfold`
option was given. In same way as to for `only` it can be followed
by an equal sign and explicit value. E.g.,
`%(trailers:only,unfold=true)` unfolds and shows all trailer lines.
** 'valueonly[=val]': skip over the key part of the trailer line and only
show the value part. Also this optionally allows explicit value.
NOTE: Some placeholders may depend on other options given to the
revision traversal engine. For example, the `%g*` reflog options will
insert an empty string unless we are traversing reflog entries (e.g., by
`git log -g`). The `%d` and `%D` placeholders will use the "short"
decoration format if `--decorate` was not already provided on the command
line.
If you add a `+` (plus sign) after '%' of a placeholder, a line-feed
is inserted immediately before the expansion if and only if the
placeholder expands to a non-empty string.
If you add a `-` (minus sign) after '%' of a placeholder, all consecutive
line-feeds immediately preceding the expansion are deleted if and only if the
placeholder expands to an empty string.
If you add a ` ` (space) after '%' of a placeholder, a space
is inserted immediately before the expansion if and only if the
placeholder expands to a non-empty string.
* 'tformat:'
+
The 'tformat:' format works exactly like 'format:', except that it
provides "terminator" semantics instead of "separator" semantics. In
other words, each commit has the message terminator character (usually a
newline) appended, rather than a separator placed between entries.
This means that the final entry of a single-line format will be properly
terminated with a new line, just as the "oneline" format does.
For example:
+
---------------------
$ git log -2 --pretty=format:%h 4da45bef \
| perl -pe '$_ .= " -- NO NEWLINE\n" unless /\n/'
4da45be
7134973 -- NO NEWLINE
$ git log -2 --pretty=tformat:%h 4da45bef \
| perl -pe '$_ .= " -- NO NEWLINE\n" unless /\n/'
4da45be
7134973
---------------------
+
In addition, any unrecognized string that has a `%` in it is interpreted
as if it has `tformat:` in front of it. For example, these two are
equivalent:
+
---------------------
$ git log -2 --pretty=tformat:%h 4da45bef
$ git log -2 --pretty=%h 4da45bef
---------------------
View Git Blame Copy Permalink