Okay, a quick update from my side.
I've created the PR that allows commit signing (see example below): #485

The commit signing was done using this signer:

class GPGCommitSigner implements CommitSigner {
  private privateKey: string;
  private passphrase: string | undefined;

  constructor({
    privateKey,
    passphrase,
  }: {
    privateKey: string;
    passphrase?: string;
  }) {
    this.privateKey = privateKey;
    this.passphrase = passphrase;
  }

  async generateSignature(commit: CommitDataWithRequiredDate): Promise<string> {
    const privateKey = await openpgp.readPrivateKey({
      armoredKey: this.privateKey,
    });

    const commitObject = this.buildCommitObject(commit);

    const message = await openpgp.createCleartextMessage({
      text: commitObject,
    });
    const signedMessage = await openpgp.sign({
      message,
      signingKeys: privateKey,
      // todo: Figure out how to use passphrases
    });

    return this.parseSignature(signedMessage);
  }

  private buildCommitObject(commit: CommitDataWithRequiredDate) {
    const rows = [];

    rows.push(`tree ${commit.tree}`);
    for (const parent of commit.parents) {
      rows.push(`parent ${parent}`);
    }
    if (commit.author) {
      rows.push(`author ${this.buildUserCommitObjectRow(commit.author)}`);
    }
    if (commit.committer) {
      rows.push(`committer ${this.buildUserCommitObjectRow(commit.committer)}`);
    }
    rows.push('');
    rows.push(commit.message);

    return rows.join('\n');
  }

  private buildUserCommitObjectRow({
    name,
    email,
    date,
  }: {
    name: string;
    email: string;
    date: Date;
  }) {
    const unixDate = Math.floor(date.getTime() / 1000);
    const timezoneOffset = this.buildTimezoneOffset(date);
    return `${name} <${email}> ${unixDate} ${timezoneOffset}`;
  }

  private buildTimezoneOffset(date: Date): string {
    const timezoneOffset = date.getTimezoneOffset();
    const timezoneOffsetAbsolute = Math.abs(timezoneOffset);
    if (timezoneOffset === 0) {
      return '+0000';
    }
    const offsetInHourFormat = (timezoneOffsetAbsolute / 60) * 100;
    const offsetString = String(offsetInHourFormat).padStart(4, '0');

    if (timezoneOffset < 0) {
      return `+${offsetString}`;
    }
    return `-${offsetString}`;
  }

  private parseSignature(signedMessage: string): string {
    const signature =
      '-----BEGIN PGP SIGNATURE-----' +
      signedMessage.split('-----BEGIN PGP SIGNATURE-----')[1];

    return signature;
  }
}

And the generated commit is verified as you can see here: simpleclub-extended@ca1c82b

I called the function like this:

const octokit = new Octokit();
const fileData = new FileData('hello world', '100644');
const changes = new Map();
changes.set('foo.md', fileData);
await suggester.createPullRequest(octokit, changes, {
  upstreamOwner: 'simpleclub-extended',
  upstreamRepo: 'code-suggester',
  title: 'Test commit signing using GPG keys',
  message: 'Test signed commit',
  description: '',
  fork: false,
  force: true,
  author: {
    name: '<name>',
    email: '<email>',
  },
  committer: {
    name: '<name>',
    email: '<email>',
  },
  signer: new GPGCommitSigner({privateKey: privateKeyArmored}),
});

@chingor13 could you review my PR to expose the date and let me know if you have a preference for where to best put the GPGCommitSigner class?

Uh oh!

Add GPG Signature option #337

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions