sds / overcommit / 42767965538

100%

master: 91%

push

github

Remember all previously approved configurations and hooks (#665)

Checking out or rebasing through an older, already approved configuration currently fails signature verification because signing a newer version overwrites the only stored approval. Remember every locally approved configuration and hook version, while continuing to reject unseen changes and unapproved combinations of hook code and configuration.

Fixes #300.

Approvals now live in `overcommit-signatures` under the repository's Git directory. Each file is indexed by the SHA256 of its signature config key and its existing SHA256 signature, and contains both values for inspection. Lookup reads one fixed-size file regardless of history length. History has no cap and does not grow `.git/config` or slow Git config reads.

This replaces the original PR's Git blob design and addresses the security concerns in its review:

- Approvals are local filesystem data outside the Git object database. Fetching attacker-controlled commits, blobs, tags, or other refs cannot grant trust.
- Git garbage collection cannot remove approvals.
- Revoke one approval by deleting its file; revoke all approvals by deleting `overcommit-signatures`. No refs, keys, or cryptographic trust infrastructure are required.
- Existing Git config signatures migrate on first use without changing their digest format. The legacy key is removed only after its approval is safely written, so deleting history does not resurrect an old approval.
- Linked worktrees share history by default. With `extensions.worktreeConfig`, both history and the existing verification setting retain their per-worktree isolation.
- A hook's code and configuration remain signed together. Individually approved components do not approve new combinations.

README documents storage, migration, worktrees, and revocation. Older Overcommit releases do not read the new history and will require re-signing if used after migration.

Validation:

- Full suite: 1,785 exam... (continued)

53 of 60 new or added lines in 7 files covered. (88.33%)

3388 of 3649 relevant lines covered (92.85%)

2089.81 hits per line