Support for signed tags

README.rst

@@ -159,6 +159,15 @@ General configuration is grouped in a ``[bumpversion]`` section.
   Also available as ``--message`` (e.g.: ``bumpversion --message
   '[{now:%Y-%m-%d}] Jenkins Build {$BUILD_NUMBER}: {new_version}' patch``)
 
+``sign = (True | False)``
+  **default:** False (`Don't sign a tag`)
+
+  Whether to sign a tag when creating it. Only implemented for git as of now.
+  Don't forget to set ``user.signingkey = 0x1234abcd`` in ``.git/config`` or
+  ``~/.gitconfig``.
+
+  Also available on the command line as ``(--sign | --no-sign)``.
+
 
 Part specific configuration
 ---------------------------

bumpversion/__init__.py

@@ -148,8 +148,12 @@ def add_path(cls, path):
         subprocess.check_output(["git", "add", "--update", path])
 
     @classmethod
-    def tag(cls, name):
-        subprocess.check_output(["git", "tag", name])
+    def tag(cls, name, message='', sign=False):
+        command = ["git", "tag"]
+        if sign:
+            command.extend(["--sign", '--message', message or name])
+        command.append(name)
+        subprocess.check_output(command)
 
 
 class Mercurial(BaseVCS):
@@ -180,7 +184,7 @@ def add_path(cls, path):
         pass
 
     @classmethod
-    def tag(cls, name):
+    def tag(cls, name, message='', sign=False):
         subprocess.check_output(["hg", "tag", name])
 
 VCS = [Git, Mercurial]
@@ -628,7 +632,7 @@ def main(original_args=None):
             except NoOptionError:
                 pass  # no default value then ;)
 
-        for boolvaluename in ("commit", "tag", "dry_run"):
+        for boolvaluename in ("commit", "tag", "dry_run", "sign"):
             try:
                 defaults[boolvaluename] = config.getboolean(
                     "bumpversion", boolvaluename)
@@ -779,6 +783,13 @@ def main(original_args=None):
                          help='Tag name (only works with --tag)',
                          default=defaults.get('tag_name', 'v{new_version}'))
 
+    signgroup = parser3.add_mutually_exclusive_group()
+
+    signgroup.add_argument('--sign', action='store_true', dest="sign", default=defaults.get("sign", False),
+                           help='Sign the tag')
+    signgroup.add_argument('--no-sign', action='store_false', dest="sign",
+                           help='Do not sign the tag', default=argparse.SUPPRESS)
+
     parser3.add_argument('--message', '-m', metavar='COMMIT_MSG',
                          help='Commit message',
                          default=defaults.get('message', 'Bump version: {current_version} → {new_version}'))
@@ -878,6 +889,7 @@ def main(original_args=None):
 
     do_commit = (not args.dry_run) and args.commit
     do_tag = (not args.dry_run) and args.tag
+    do_sign = do_tag and args.sign
 
     logger.info("{} {} commit".format(
         "Would prepare" if not do_commit else "Preparing",
@@ -919,6 +931,12 @@ def main(original_args=None):
         vcs.__name__
     ))
 
-    if do_tag:
-        vcs.tag(tag_name)
+    if args.sign:
+        logger.info("{} '{}' in {}".format(
+            "Would sign tag" if not do_sign else "Signing",
+            tag_name,
+            vcs.__name__
+        ))
 
+    if do_tag:
+        vcs.tag(tag_name, message=commit_message, sign=do_sign)

tests/test_cli.py

@@ -120,6 +120,8 @@ def _mock_calls_to_string(called_mock):
   --no-tag              Do not create a tag in version control
   --tag-name TAG_NAME   Tag name (only works with --tag) (default:
                         v{new_version})
+  --sign                Sign the tag (default: False)
+  --no-sign             Do not sign the tag
   --message COMMIT_MSG, -m COMMIT_MSG
                         Commit message (default: Bump version:
                         {current_version} → {new_version})
@@ -1026,6 +1028,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8
         commit = True
         tag = True
+        sign = True
         serialize =
           {major}.{minor}.{patch}
           {major}.{minor}
@@ -1047,6 +1050,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8
         commit = True
         tag = True
+        sign = True
         serialize =
           {major}.{minor}.{patch}
           {major}.{minor}
@@ -1073,6 +1077,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         current_version = 0.8.1
         commit = True
         tag = True
+        sign = True
         serialize = 
         	{major}.{minor}.{patch}
         	{major}.{minor}
@@ -1084,6 +1089,7 @@ def test_subjunctive_dry_run_logging(tmpdir, vcs):
         info|Would add changes in file '.bumpversion.cfg' to Git|
         info|Would commit to Git with message 'Bump version: 0.8 \u2192 0.8.1'|
         info|Would tag 'v0.8.1' in Git|
+        info|Would sign tag 'v0.8.1' in Git|
         """).strip()
 
     if vcs == "hg":