From e9dbe231b66c24546754a25cfd9be0aeec437d81 Mon Sep 17 00:00:00 2001
From: Markus Holtermann <info@markusholtermann.eu>
Date: Sun, 1 Feb 2015 02:01:11 +0100
Subject: [PATCH] Added support to sign Git tags

---
 README.rst              |  9 +++++++++
 bumpversion/__init__.py | 30 ++++++++++++++++++++++++------
 tests.py                |  6 ++++++
 3 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/README.rst b/README.rst
index f8be096..23143f5 100644
--- a/README.rst
+++ b/README.rst
@@ -159,6 +159,15 @@ General configuration is grouped in a ``[bumpversion]`` section.
   Also available as ``--message`` (e.g.: ``bumpversion --message
   '[{now:%Y-%m-%d}] Jenkins Build {$BUILD_NUMBER}: {new_version}' patch``)
 
+``sign = (True | False)``
+  **default:** False (`Don't sign a tag`)
+
+  Whether to sign a tag when creating it. Only implemented for git as of now.
+  Don't forget to set ``user.signingkey = 0x1234abcd`` in ``.git/config`` or
+  ``~/.gitconfig``.
+
+  Also available on the command line as ``(--sign | --no-sign)``.
+
 
 Part specific configuration
 ---------------------------
diff --git a/bumpversion/__init__.py b/bumpversion/__init__.py
index ccfaff0..526e929 100644
--- a/bumpversion/__init__.py
+++ b/bumpversion/__init__.py
@@ -146,8 +146,12 @@ def add_path(cls, path):
         subprocess.check_output(["git", "add", "--update", path])
 
     @classmethod
-    def tag(cls, name):
-        subprocess.check_output(["git", "tag", name])
+    def tag(cls, name, message='', sign=False):
+        command = ["git", "tag"]
+        if sign:
+            command.extend(["--sign", '--message', message or name])
+        command.append(name)
+        subprocess.check_output(command)
 
 
 class Mercurial(BaseVCS):
@@ -178,7 +182,7 @@ def add_path(cls, path):
         pass
 
     @classmethod
-    def tag(cls, name):
+    def tag(cls, name, message='', sign=False):
         subprocess.check_output(["hg", "tag", name])
 
 VCS = [Git, Mercurial]
@@ -705,7 +709,7 @@ def main(original_args=None):
             except NoOptionError:
                 pass  # no default value then ;)
 
-        for boolvaluename in ("commit", "tag", "dry_run"):
+        for boolvaluename in ("commit", "tag", "dry_run", "sign"):
             try:
                 defaults[boolvaluename] = config.getboolean(
                     "bumpversion", boolvaluename)
@@ -856,6 +860,13 @@ def main(original_args=None):
                          help='Tag name (only works with --tag)',
                          default=defaults.get('tag_name', 'v{new_version}'))
 
+    signgroup = parser3.add_mutually_exclusive_group()
+
+    signgroup.add_argument('--sign', action='store_true', dest="sign", default=defaults.get("sign", False),
+                           help='Sign the tag')
+    signgroup.add_argument('--no-sign', action='store_false', dest="sign",
+                           help='Do not sign the tag', default=argparse.SUPPRESS)
+
     parser3.add_argument('--message', '-m', metavar='COMMIT_MSG',
                          help='Commit message',
                          default=defaults.get('message', 'Bump version: {current_version} → {new_version}'))
@@ -955,6 +966,7 @@ def main(original_args=None):
 
     do_commit = (not args.dry_run) and args.commit
     do_tag = (not args.dry_run) and args.tag
+    do_sign = do_tag and args.sign
 
     logger.info("{} {} commit".format(
         "Would prepare" if not do_commit else "Preparing",
@@ -996,6 +1008,12 @@ def main(original_args=None):
         vcs.__name__
     ))
 
-    if do_tag:
-        vcs.tag(tag_name)
+    if args.sign:
+        logger.info("{} '{}' in {}".format(
+            "Would sign tag" if not do_sign else "Signing",
+            tag_name,
+            vcs.__name__
+        ))
 
+    if do_tag:
+        vcs.tag(tag_name, message=commit_message, sign=do_sign)
diff --git a/tests.py b/tests.py
index 1f467fc..6293495 100644
--- a/tests.py
+++ b/tests.py
@@ -119,6 +119,8 @@ def _mock_calls_to_string(called_mock):
   --no-tag              Do not create a tag in version control
   --tag-name TAG_NAME   Tag name (only works with --tag) (default:
                         v{new_version})
+  --sign                Sign the tag (default: False)
+  --no-sign             Do not sign the tag
   --message COMMIT_MSG, -m COMMIT_MSG
                         Commit message (default: Bump version:
                         {current_version} → {new_version})
@@ -1021,6 +1023,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8
         commit = True
         tag = True
+        sign = True
         serialize =
           {major}.{minor}.{patch}
           {major}.{minor}
@@ -1042,6 +1045,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8
         commit = True
         tag = True
+        sign = True
         serialize =
           {major}.{minor}.{patch}
           {major}.{minor}
@@ -1066,6 +1070,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8.1
         commit = True
         tag = True
+        sign = True
         serialize = 
         	{major}.{minor}.{patch}
         	{major}.{minor}
@@ -1077,6 +1082,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         info|Would add changes in file '.bumpversion.cfg' to Git|
         info|Would commit to Git with message 'Bump version: 0.8 \u2192 0.8.1'|
         info|Would tag 'v0.8.1' in Git|
+        info|Would sign tag 'v0.8.1' in Git|
         """).strip()
 
     if vcs == "hg":