Verify git commits are gpg signed

Change-Id: I2e38ee89cb5c05bc8a6346e7d95a4001669235d4
Signed-off-by: Anil Belur <abelur@linuxfoundation.org>

diff --git a/jjb/include-raw-verify-gpg-signatures.sh b/jjb/include-raw-verify-gpg-signatures.sh
new file mode 100644 (file)
index 0000000..4e1b294
--- /dev/null
+++ b/jjb/include-raw-verify-gpg-signatures.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+git log --show-signature -1 | egrep -q 'gpg: Signature made.*key ID'
+if [ $? -eq 0 ]; then
+   echo "git commit is gpg signed"
+else
+   echo "WARNING: gpg signature missing for the commit"
+fi
+
+# Don't fail the job for unsigned commits
+exit 0

diff --git a/jjb/releng-jobs.yaml b/jjb/releng-jobs.yaml
index b17cd9cec69930c4f39c814714034c4261a358b6..0d63fb01cbe09a8b5634127a876b07e2bb710234 100644 (file)
--- a/jjb/releng-jobs.yaml
+++ b/jjb/releng-jobs.yaml
@@ -86,6 +86,7 @@
             gzip archives/job_output/*
 
         - releng-check-unicode
+        - verify-gpg-signature
 
     publishers:
         - email-notification:
@@ -129,6 +130,7 @@
             files: 'scripts/**'
 
     builders:
+        - verify-gpg-signature
         - shell: |
             virtualenv $WORKSPACE/venv
             source $WORKSPACE/venv/bin/activate

diff --git a/jjb/releng-macros.yaml b/jjb/releng-macros.yaml
index f13bef94192cdf1c42a9f7fb90e569329ef9d36d..802247b97ce01d653561e5a4387c3cdbaa2f80ab 100644 (file)
--- a/jjb/releng-macros.yaml
+++ b/jjb/releng-macros.yaml
@@ -419,3 +419,11 @@
                         packer.io build -var-file=$CLOUDENV \
                          -var-file=../packer/vars/{platform}.json \
                          ../packer/templates/{template}.json
+
+- builder:
+    # TODO: Verify signature after downloading users public key from a locally created
+    # repository instead of the public keymesh. This requires a process in place to get ODL
+    # developers public keys into a local repository without increasing the job thoughput.
+    name: verify-gpg-signature
+    builders:
+        - shell: !include-raw: include-raw-verify-gpg-signatures.sh