Repository: palantir/policy-bot
Pull request #504 (2022-11-30 19:22:01)

SSH signatures support
Hi,

SSH signed commits are currently ignored because the field type was unknown.

This PR adds basic support for it.

palantirtech: Thanks for your interest in [palantir/policy-bot](https://github.com/palantir/policy-bot), @fpoussin! Before we can accept your pull request, you need to sign our contributor license agreement - just visit https://cla.palantir.com/ and follow the instructions. Once you sign, I'll automatically update this pull request.

Patch:
diff --git a/pull/context.go b/pull/context.go
index 44da64b..d093206 100644
--- a/pull/context.go
+++ b/pull/context.go
@@ -173,14 +173,16 @@ type SignatureType string
 const (
 	SignatureGpg   SignatureType = "GpgSignature"
 	SignatureSmime SignatureType = "SmimeSignature"
+	SignatureSSH   SignatureType = "SshSignature"
 )
 
 type Signature struct {
-	Type    SignatureType
-	IsValid bool
-	KeyID   string
-	Signer  string
-	State   string
+	Type           SignatureType
+	IsValid        bool
+	KeyID          string
+	KeyFingerprint string
+	Signer         string
+	State          string
 }
 
 type Comment struct {
diff --git a/pull/github.go b/pull/github.go
index d508edb..3ad7287 100644
--- a/pull/github.go
+++ b/pull/github.go
@@ -1179,6 +1179,7 @@ type v4GitSignature struct {
 	Type  string           `graphql:"__typename"`
 	GPG   v4GpgSignature   `graphql:"... on GpgSignature"`
 	SMIME v4SmimeSignature `graphql:"... on SmimeSignature"`
+	SSH   v4SshSignature   `graphql:"... on SshSignature"`
 }
 
 func (s *v4GitSignature) ToSignature() *Signature {
@@ -1198,6 +1199,14 @@ func (s *v4GitSignature) ToSignature() *Signature {
 			State:   s.SMIME.State,
 			Type:    SignatureSmime,
 		}
+	case SignatureSSH:
+		return &Signature{
+			IsValid:        s.SSH.IsValid,
+			KeyFingerprint: s.SSH.KeyFingerprint,
+			Signer:         s.SSH.Signer.GetV3Login(),
+			State:          s.SSH.State,
+			Type:           SignatureSSH,
+		}
 	default:
 		return nil
 	}
@@ -1223,3 +1232,14 @@ type v4GpgSignature struct {
 	State             string
 	WasSignedByGitHub bool
 }
+
+type v4SshSignature struct {
+	Email             string
+	IsValid           bool
+	KeyFingerprint    string
+	Payload           string
+	Signature         string
+	Signer            *v4Actor
+	State             string
+	WasSignedByGitHub bool
+}


Test patch:
diff --git a/policy/predicate/signature_test.go b/policy/predicate/signature_test.go
index 0733f74..9a33f06 100644
--- a/policy/predicate/signature_test.go
+++ b/policy/predicate/signature_test.go
@@ -30,7 +30,7 @@ func TestHasValidSignatures(t *testing.T) {
 
 	testCases := []SignatureTestCase{
 		{
-			"ValidSignature",
+			"ValidGpgSignature",
 			&pulltest.Context{
 				AuthorValue: "mhaypenny",
 				CommitsValue: []*pull.Commit{
@@ -54,6 +54,31 @@ func TestHasValidSignatures(t *testing.T) {
 				ConditionValues: []string{"valid signatures"},
 			},
 		},
+		{
+			"ValidSshSignature",
+			&pulltest.Context{
+				AuthorValue: "mhaypenny",
+				CommitsValue: []*pull.Commit{
+					{
+						SHA:       "abcdef123456789",
+						Author:    "mhaypenny",
+						Committer: "mhaypenny",
+						Signature: &pull.Signature{
+							Type:           pull.SignatureSSH,
+							IsValid:        true,
+							Signer:         "ttest",
+							State:          "VALID",
+							KeyFingerprint: "Hello",
+						},
+					},
+				},
+			},
+			&common.PredicateResult{
+				Satisfied:       true,
+				Values:          []string{"abcdef123456789"},
+				ConditionValues: []string{"valid signatures"},
+			},
+		},
 		{
 			"InvalidSignature",
 			&pulltest.Context{