What the developer wrote
Authored by Nicolas Dorier
Improve pgpkey verif
What changed, and why it matters
This commit tightens a CI script that checks whether Git commits are cryptographically signed. Previously, the script only rejected commits with status 'N' (no signature). Now it accepts only 'G' (valid trusted signature) or 'U' (valid but untrusted signature) and rejects everything else. This is a hardening improvement, not a fix for an active security flaw.
No immediate action required. The change is a defensive hardening measure. Review whether 'U' (untrusted but valid signature) should be accepted in your threat model, and consider documenting the allowed signature states.
Security signals we found
Hardening of commit signature verification in CI
Rejection of bad/expired/revoked signature states that were previously not explicitly rejected
No evidence of an exploitable vulnerability in the diff
Evidence from the diff
The change updates .circleci/verify-signed-commit.sh to use a case statement on git’s %G? format output. It now permits only ‘G’ (good, valid signature from a trusted key) and ‘U’ (good, valid signature from an untrusted key), rejecting ‘N’ (no signature), ‘B’ (bad signature), ‘X’ (expired key), ‘Y’ (expired signature), ‘R’ (revoked key), and any other unexpected status. This prevents weaker or invalid signature states from passing CI.
Changed components
.circleci/verify-signed-commit.shInspect captured patch +8 / −3
diff --git a/.circleci/verify-signed-commit.sh b/.circleci/verify-signed-commit.sh
index 921d47a..672c041 100755
--- a/.circleci/verify-signed-commit.sh
+++ b/.circleci/verify-signed-commit.sh
@@ -2,7 +2,12 @@
set -e
echo "Checking commit signature..."
-if git log -1 --format="%G?" HEAD | grep -q "^N$"; then
- echo "ERROR: Commit is not signed"
+status=$(git log -1 --format="%G?" HEAD)
+
+case "$status" in
+ G|U) ;; # signed (trusted or not)
+ *)
+ echo "ERROR: commit is not properly signed (status: $status)"
exit 1
-fi
+ ;;
+esac
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.