{"action":"created","issue":{"url":"https://api.github.com/repos/concourse/git-resource/issues/138","repository_url":"https://api.github.com/repos/concourse/git-resource","labels_url":"https://api.github.com/repos/concourse/git-resource/issues/138/labels{/name}","comments_url":"https://api.github.com/repos/concourse/git-resource/issues/138/comments","events_url":"https://api.github.com/repos/concourse/git-resource/issues/138/events","html_url":"https://github.com/concourse/git-resource/pull/138","id":249775575,"number":138,"title":"Request-for-comments: Add git tag signature verification","user":{"login":"keymon","id":280032,"avatar_url":"https://avatars0.githubusercontent.com/u/280032?v=4","gravatar_id":"","url":"https://api.github.com/users/keymon","html_url":"https://github.com/keymon","followers_url":"https://api.github.com/users/keymon/followers","following_url":"https://api.github.com/users/keymon/following{/other_user}","gists_url":"https://api.github.com/users/keymon/gists{/gist_id}","starred_url":"https://api.github.com/users/keymon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keymon/subscriptions","organizations_url":"https://api.github.com/users/keymon/orgs","repos_url":"https://api.github.com/users/keymon/repos","events_url":"https://api.github.com/users/keymon/events{/privacy}","received_events_url":"https://api.github.com/users/keymon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-08-12T00:23:37Z","updated_at":"2017-08-31T16:35:12Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/concourse/git-resource/pulls/138","html_url":"https://github.com/concourse/git-resource/pull/138","diff_url":"https://github.com/concourse/git-resource/pull/138.diff","patch_url":"https://github.com/concourse/git-resource/pull/138.patch"},"body":"What?\r\n----\r\n\r\nWe want to implement the case of adding verification the tags instead of commit only. \r\n\r\nOur specific use case is that we want a human to sign a tag to give the \"seal of approval\" of some code to be automatically deployed into prod.\r\n\r\nMy intention is keep the current behaviour and be fully backwards compatible, but optionally disable the commit verification and enable tag verification. When verifying the tags, I think it should be enough to verify that at least one tag is signed, as usually a commit can have multiple unsigned tags and one signed tag.\r\n\r\nI think the setting should be passed as a parameter in the `get:`. That would allow the user to use different verifications in different jobs, or even disable the verification for some cases.\r\n\r\nIn this PR I propose one implementation, but there are different alternatives and I would like to request feedback first.\r\n\r\nOption 1\r\n--------\r\n\r\n(Currently implemented)\r\n\r\nAllow pass the parameter `verify` with a list of elements to verify. Valid values are \"commit\" and \"tags\".\r\n\r\n\"commit\": Will verify the current commit signed, meanwhile \"tags\" will verify that AT LEAST one tag is signed with the provided keys.\r\n\r\nThe default value is `verify: [\"commit\"]`, which keeps the current behaviour. If the user passes `verify: []` it would disable any the verification.\r\n\r\nOption 1.b: `verify` can get \"commit\", \"all_tags\" or \"any_tag\"\r\n\r\nOption 2\r\n--------\r\n\r\nAllow pass two new attributes:\r\n - verify_commit: true|false. Default: true.\r\n - verify_tags: true|false. Default: false\r\n\r\nOption 2.b: do also `verify_all_tags` `verify_any_tag`\r\n\r\nOther comments\r\n-------------\r\n\r\nIf we verify commits and tags, the prefix `commit_` config `commit_verification_keys` and `commit_verification_key_ids` makes less sense. Maybe we should deprecate that option and provide alternatives like:  `gpg_verification_keys` and `gpg_verification_key_ids` or similar."},"comment":{"url":"https://api.github.com/repos/concourse/git-resource/issues/comments/326352234","html_url":"https://github.com/concourse/git-resource/pull/138#issuecomment-326352234","issue_url":"https://api.github.com/repos/concourse/git-resource/issues/138","id":326352234,"user":{"login":"jtarchie","id":75184,"avatar_url":"https://avatars2.githubusercontent.com/u/75184?v=4","gravatar_id":"","url":"https://api.github.com/users/jtarchie","html_url":"https://github.com/jtarchie","followers_url":"https://api.github.com/users/jtarchie/followers","following_url":"https://api.github.com/users/jtarchie/following{/other_user}","gists_url":"https://api.github.com/users/jtarchie/gists{/gist_id}","starred_url":"https://api.github.com/users/jtarchie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtarchie/subscriptions","organizations_url":"https://api.github.com/users/jtarchie/orgs","repos_url":"https://api.github.com/users/jtarchie/repos","events_url":"https://api.github.com/users/jtarchie/events{/privacy}","received_events_url":"https://api.github.com/users/jtarchie/received_events","type":"User","site_admin":false},"created_at":"2017-08-31T16:35:12Z","updated_at":"2017-08-31T16:35:12Z","author_association":"CONTRIBUTOR","body":"@keymon, I'm not familiar with this workflow. It makes _sense_, but cannot make a judgement call if it is **right**.  Or in emoji form `¯\\_(ツ)_/¯`.\r\n\r\nThe git resource is trying to do too much. Supporting tags and branches with their workflows is polluting the git resource with lots of conditional logic.\r\n\r\nI'm working on a [proposal](https://github.com/concourse/git-resource/issues/145) to perhaps create a git tag resource. It is a little barren as I'm tracking tag related issues.\r\n\r\nWe are talking to people about their needs and workflows for tags. Would you be willing to have a conversation with me and @jama-pivotal?"}}
{"actor":{"display_login":"jtarchie"}}