IJHack / QtPass / 40587036517

93%

push

github

Sign git commits when the store asks, as pass does (pass.signcommits) (#2070)

* Sign git commits when the store asks, as pass does (pass.signcommits)

pass's git_commit() adds -S when `git config --bool pass.signcommits` is
true for the store. QtPass's own commits never did, so a store whose
history is meant to be signed got unsigned commits from QtPass next to
the signed ones from pass.

- ImitatePass::commitArgs(): "commit", plus "-S" when the setting is
  true, asked before each commit as pass does; used by every commit
  (queued and blocking: entries, .gpg-id, re-encryption, the backup).
- RealPass: its one direct `pass git commit` (removing a linked folder)
  asks the same; pass's own commits already sign.
- ProfileInit: the first commits of a new store honour it from the
  user's Git config.
- Git's own signing setup applies (user.signingkey, gpg.format). A
  commit that cannot be signed fails and is reported, not made unsigned.

Test: a stand-in gpg.program, with the user's global and system Git
config shut out (a global gpg.format=ssh would otherwise sign with the
user's real key): unsigned without the setting, signed with it, and a
failing signer makes the commit fail with HEAD unchanged.

Part of #2058.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* RealPass: a commit that failed is reported, though pass exits 0

CodeRabbit: `pass git commit` runs git in the branch of cmd_git() whose
status pass drops (the script ends in exit 0), so a commit that failed,
now also one whose signer would not sign, read as done and the link's
removal stayed staged and unsynchronised. The commit runs blocking and
is judged by what is left staged (`git diff --cached --name-only`): a
failure is reported as "Delete incomplete", with git's message.

Also: the signing test restores a GIT_CONFIG_NOSYSTEM it found set.

Co-Authored... (continued)

69 of 70 new or added lines in 3 files covered. (98.57%)

9485 of 10255 relevant lines covered (92.49%)

303.46 hits per line