Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get commit or tag signature verified flag #738

Merged
merged 5 commits into from
Mar 26, 2020

Conversation

sourabhsparkala
Copy link
Contributor

This fixes #737

Description

  • A new entity GHVerification.java has been added which would be reflecting Verification flag.
  • Updating GHCommit.java and GHTagObject.java with GHVerification.
  • Altering few test cases AppTest.java and GHTagTest.java to verify if the Verification entity is being picked up.
  • A separate test class SignatureVerificationTest.java with the associated wiremock test resources

Copy link

@artem-smotrakov artem-smotrakov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this new API @sourabhsparkala ! I hope the changeset will be accepted and released soon.

@SuppressFBWarnings(value = { "UWF_UNWRITTEN_PUBLIC_OR_PROTECTED_FIELD", "UWF_UNWRITTEN_FIELD", "NP_UNWRITTEN_FIELD" },
justification = "JSON API")
public class GHVerification {
private String reason, signature, payload;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make sense to create a enum which holds all possible reasons? The following page defines possible reasons (please see the "Signature verification object" section):

https://developer.github.com/v3/repos/commits/

private boolean verified;

/**
* Gets boolean value.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: How about "Indicates whether GitHub considers the signature in this commit to be verified"? (borrowed from https://developer.github.com/v3/repos/commits/)

}

/**
* Gets payload used for the verification.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest "Gets the payload that was signed."

@sourabhsparkala
Copy link
Contributor Author

Thank you for the review @artem-smotrakov. Please let me know if there are any more changes.

Copy link

@artem-smotrakov artem-smotrakov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me. Just one comment below.

INVALID("invalid"),
VALID("valid");

private final String value;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if value is necessary.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@artem-smotrakov
In general, you'd be correct. But I think the default mapping for enums is all-caps and convert-underscores-to-dashes. Which would result in EXPIRED_KEY converting to expired-key and vice versa. Once tests are added, we can see whether this is needed or not.

* @author Sourabh Sarvotham Parkala
*/
public enum GHReason {
EXPIRED_KEY("expired_key"),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need at test for each of these values. Or at least a bunch of them. Even if you have to manually create them.

INVALID("invalid"),
VALID("valid");

private final String value;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@artem-smotrakov
In general, you'd be correct. But I think the default mapping for enums is all-caps and convert-underscores-to-dashes. Which would result in EXPIRED_KEY converting to expired-key and vice versa. Once tests are added, we can see whether this is needed or not.

@@ -584,6 +584,8 @@ public void testCommitShortInfo() throws Exception {
GHCommit commit = r.getCommit("86a2e245aa6d71d54923655066049d9e21a15f23");
assertEquals(commit.getCommitShortInfo().getAuthor().getName(), "Kohsuke Kawaguchi");
assertEquals(commit.getCommitShortInfo().getMessage(), "doc");
assertFalse(commit.getCommitShortInfo().getVerification().getVerified());
assertEquals(commit.getCommitShortInfo().getVerification().getReason(), GHReason.UNSIGNED.get());
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As noted above, we need tests for at least a few more GHReason values (specifically multi-word values).

@bitwiseman
Copy link
Member

@sourabhsparkala You see we need some tests right?

@sourabhsparkala
Copy link
Contributor Author

@sourabhsparkala You see we need some tests right?

@bitwiseman I am working on the tests now.

This fixes hub4j#737

- A new entity GHVerification.java has been added which would be reflecting Verification flag
- Updating GHCommit.java and GHTagObject.java with GHVerification
- Altering few test cases AppTest.java and GHTagTest.java to verify if the Verification entity is being picked up
- A separate test class SignatureVerificationTest.java with the associated wiremock test resources
- Adding a new enum GHReason.java
- Updating tests to check the GHReason implementation, GHReasonTest.java with the associated wiremock test resources
@sourabhsparkala
Copy link
Contributor Author

@bitwiseman I have added the test cases as advised.

@bitwiseman bitwiseman merged commit ca640b3 into hub4j:master Mar 26, 2020
@sourabhsparkala
Copy link
Contributor Author

@bitwiseman Thank you for reviewing and merging the PR.

@sourabhsparkala sourabhsparkala deleted the sign_verification branch March 27, 2020 07:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Get commit or tag signature verified flag
3 participants