pre-push

#!/bin/sh
#
# pre-push hook: refuse to push if any commit being pushed is unsigned.
# A commit is considered unsigned when git's %G? placeholder reports 'N'.

# All-zeros OID of the correct length for this repo's hash algorithm.
zero=$(git hash-object --stdin </dev/null | tr '0-9a-f' '0')

unsigned=""

while read -r local_ref local_oid remote_ref remote_oid
do
	# Branch deletion — nothing to verify.
	[ "$local_oid" = "$zero" ] && continue

	if [ "$remote_oid" = "$zero" ]; then
		# New ref: check commits not already present on any remote ref.
		range=$(git rev-list "$local_oid" --not --remotes)
	else
		# Existing ref: check only the newly added commits.
		range=$(git rev-list "$remote_oid..$local_oid")
	fi

	for commit in $range; do
		sig=$(git show --no-patch --format='%G?' "$commit")
		[ "$sig" = "N" ] && unsigned="$unsigned $commit"
	done
done

if [ -n "$unsigned" ]; then
	echo "pre-push: refusing to push — unsigned commit(s) detected:" >&2
	for commit in $unsigned; do
		git show --no-patch --format='  %h %s' "$commit" >&2
	done
	echo >&2
	echo "Sign them, e.g.:" >&2
	echo "  git rebase --exec 'git commit --amend --no-edit -S' <base>" >&2
	exit 1
fi

exit 0