[Feature] Show if commit is signed with gpg

[Masgalor]

Commits can be signed using gpg so my expectation was to see some information about cryptographic signatures for every commit.

I would imagine to have some indicator that shows me if a commit is:

• unsigned
• signed, signature is broken
• signed, signature is good

Maybe an icon changing colors depending on the status (grey/red/green).

It would already be an improvement to have access to the output of git verify-commit without using the cli.

[dougcunha]

I have a few ideas on how to implement this. If @love-linger is okay with it, I'd be happy to take a look.

[love-linger]

To verify a commit, the public key is needed...

PS: it's not needed to use anthor git command git verify-commit to get the verify result. Instead, %G? of --pretty=format: option in git log command will directly give the result

[love-linger]

For example, without public keys:

According to the git log document

There's no 'G' printed.

[love-linger]

One more thing, the above command sometimes takes more than 1 second on my PC (14700K)...

[gadfly3173]

One more thing, the above command sometimes takes more than 1 second on my PC (14700K)...

GPG signature checking is calculated for each commit individually, so the more commits you check, the more time it takes to complete. Github's commit list also displays signature status very slowly and asynchronously.

GitKraken, which has a GPG signature check feature, only displays the signature status in the commit details and does not seem to rely on the gpg.ssh.allowedSignersFile configuration. It may have implemented additional signature checks on its own.

[love-linger]

GitKraken, which has a GPG signature check feature, only displays the signature status in the commit details and does not seem to rely on the gpg.ssh.allowedSignersFile configuration. It may have implemented additional signature checks on its own.

You can just set -c gpg.ssh.allowedSignersFile=/dev/null in git log command if gpg.ssh.allowedSignersFile is not set by user. For example:

git -c gpg.ssh.allowedSignersFile=/dev/null log -10 --date-order --no-show-signature --decorate=full --pretty=format:"%H %G?"

[dougcunha]

GitKraken, which has a GPG signature check feature, only displays the signature status in the commit details and does not seem to rely on the gpg.ssh.allowedSignersFile configuration. It may have implemented additional signature checks on its own.

I don't see a problem with this approach. SublimeMerge only displays the signature status in the commit details as well and it works very well.

[love-linger]