git filter-branch和签名提交的意外行为 [英] Unexpected behavior with git filter-branch and signed commits

问题描述

请考虑以下示例.

mkdir pgp-git-test
cd pgp-git-test
git init
touch a.txt
git add a.txt
git commit -m "Add a.txt" -S
touch b.txt
git add b.txt
git commit -m "Add b.txt" -S
git filter-branch --index-filter 'git rm --cached --ignore-unmatch a.txt' --prune-empty HEAD
git log --oneline --decorate
b4efdf0 (HEAD -> master)  iQIcBAABCgAGBQJVrvqHAAoJEGuo23L9/VuyntUQAIBD0g03rTKRkOd9eM4bJgUV  jJezu7R4J0U+zVLrsrSl8oTrYrKPL5QAIqqaB9978qSx5WsmCJj8EfIZ2lwFj7kI  sWWcqjAWcRjWrte/v7ehUyTpJF6h5mWJPbC31BueZ3qlVvvfI03NbMUGocm1VOvE  KZakYkbhrA4ucA0K0YH9RKFo59cLS48SB7DQK4dBfdJSOnBC0Ga9pgBp8wnF2TQG  znRA3MnGRPJMRxZsend5P6gyeGl3wo0J/yk8HDFZXudTRS3SLB+um3NcTXRLIE9Z  Whud2oERKE9CuHU8Y64prbKKA27vWgaVQOC44ujaCqbYXuq+4Ozs34PBlf3CjJqW  19GdVBlqFfiyCPULwyxoPWkRk2kPQyEejt+sJIXG9QgefvoqFF5oLW/YA7AOrDSE  luLbC8uxmTARCWGZVGINL7NmPmEVFDZVj9EyYOjxE/+0wm4cGNBHrL6/JMkVOgpT  pWlgZWR3rX4IjzYtN6DMqKYNWVkVawZQUPh5n5jteuripWtnu5IG8vvvK2mtlkQ3  1OZIdQNAv0HYhBO0vHlV0o2TlVL5x9WfPFn+1XJepJUcoN3MdzXLxN27njdW5Bti  olEqyHrTRxYJNZgSwpQ7WITheIFDqpdcoUV2h4hNjGcXfc0DfaevtCA/oQir+3L4  JlFB35Le9Yby9htVhlu2  =RJi9  -----END PGP SIGNATURE-----
9f82e63  iQIcBAABCgAGBQJVrvp7AAoJEGuo23L9/Vuy/3QP/itaNGwRtlPB4uajGGHMUPxn  gnzd5k5gaWvWlE0Cn/v+CFqE9zVfNiqfsEwJ5YUycUNtEuF9rsiqeQWaWdHWquqr  kOEwRx/9mliK7iC2MZBn/biY5wBE2VcO2m281SnCKxslCjHJxlBo9rglq1t0wybT  CX7C7ScKAtYkos4c1vL0D5Bam2panVXs/KT/YDgWZT9kTg+lEd7NaIwxxNn7HNs7  sOvI2zLyca2FepahF99ZRGg1kKXarVh9nW4mZ1GfeAUuCNSwgwBv+NO3wFC1Blcp  uzKAo1F/cN0rAOr0bMdIZ0qJEVMBBpaqodqRqCOcmYTm5CoKFmcNJvixPl+hYsQx  mPFxM0yVsjlLAnIckNqos/T3i6T8zrb5X4g5ZwuQZzzNKy1xx809v9erb2HHK+d1  +MqdzwEcMyGqfyhz9s1BGrwpBk5CAg2MXbtPpoMTBIG7hmke1al89jvgBiuir06E  kEN6jl/2yAfsj7k5ryjFQNSPJ+HYEyvYBCx3u+xXdA5IBH6CU2S44RqugwztbVKz  /Viel4wIHJ8UCA85ZiprRWJE+nz1RXKlBZc/37W4vcSUSTELXEkhaybOM/eBKACR  sDHOKq5MG9VmZXcu0Zs0cyEvuqljSnZggbDasXHj68b86rB5VRGIO10ad1xKPnFZ  PTUmKKtz1NZkMmjIX4vR  =Mnxi  -----END PGP SIGNATURE-----

我有两个问题.首先，为什么不从日志中删除第一次提交?其次，为什么PGP签名现在位于提交消息的顶部，并且有一种方法可以避免使用 git filter-branch 时的这种行为?

I have two questions. First, why does this not remove the first commit from the log? And, second, why is the PGP signature now at the top of the commit message and is there a way to avoid this behavior when using git filter-branch?

(如果很重要，我使用的是git v.2.4.6.)

(In case it matters, I'm using git v. 2.4.6.)

推荐答案

在这个玩具示例中，为什么没有从历史记录中删除第一次提交，我没有答案.

I don't have an answer as to why the first commit has not been removed from the history in this toy example.

但是，关于第二个问题，这似乎是设计使然.使用 git filter-branch 时，PGP签名被故意破坏，以防止某人修改已签名的提交的内容，并使得签署该签名的人看起来已经对已修改的内容进行了签名.的提交.

However, as for the second question, it seems that this is status by design. The PGP signature is deliberately broken when using git filter-branch so as to prevent someone from modifying the contents of a signed commit and making it seem like the person who signed the commit has signed off on the modified contents of the commit.

大概是损坏的签名也放置在提交消息的顶部，以引起人们对这一事实的注意.

Presumably the broken signature is also placed at the top of the commit message to draw attention to this fact.

对于我来说，由于所有签名都以 iQIcBA 之类的开头，因此我可以通过执行以下操作来删除损坏的签名.

In my case, since all of the signatures start with something like iQIcBA, I was able to remove the broken signatures by doing the following.

git filter-branch --msg-filter 'sed "/iQIcBA.*/,/.*END PGP SIGNATURE.*/d"' HEAD

如果您想辞职，则可以执行以下操作.

If you want to resign the commits, you could do something like the following.

git filter-branch --commit-filter 'git commit-tree -S "$@"' HEAD

但是，似乎最好是对标签进行签名而不是对所有提交进行追溯签名(请参见 eg ，

However, it seems that signing a tag rather than retroactively signing all of the commits is preferred (see, e.g., here).

^{此答案很大程度上基于Jacob Keller对} 查看全文