Sign release tags

2 files changed, 12 insertions, 6 deletions

diff --git a/bumper b/bumper
index fe37f14..41f50a4 100755
--- a/bumper
+++ b/bumper
@@ -37,7 +37,7 @@ class Bumper(cliapp.Application):
         name = self.get_project_name()
         tag_name = '{}-{}'.format(name, version)
         msg = 'Release version {}'.format(version)
-        cliapp.runcmd(['git', 'tag', '-am', msg, tag_name])
+        cliapp.runcmd(['git', 'tag', '-sam', msg, tag_name])
 
     def get_project_name(self):
         output = cliapp.runcmd(['python', 'setup.py', '--name'])
diff --git a/bumper.yarn b/bumper.yarn
index 3cfa081..384ef75 100644
--- a/bumper.yarn
+++ b/bumper.yarn
@@ -59,7 +59,7 @@ also stored.
 We run Bumper, and it does several things.
 
     WHEN user runs "bumper 3.2 foolib/version.py" in the foo directory
-    THEN git repository foo has tag foo-3.2
+    THEN git repository foo has tag foo-3.2, signed with AA8CD13C
     AND in foo, tag foo-3.2, foolib/version.py contains
     ... "__version__ = "3.2"\n__version_info__ = (3, 2)\n"
     AND file foolib/version.py in foo contains
@@ -83,6 +83,8 @@ for Bumper.
     cliapp.runcmd(
         ['gpg', '--list-keys', keyid],
         cwd=os.environ['HOME'])
+    # Configure git to use this key for signing.
+    cliapp.runcmd(['git', 'config', '--global', 'user.signingkey', keyid])
 
     IMPLEMENTS GIVEN Python project (\S+), version controlled by git
     import os, cliapp, yarnstep
@@ -138,9 +140,13 @@ for Bumper.
     print 'actual:', repr(actual_data)
     assert wanted_data == actual_data
 
-    IMPLEMENTS THEN git repository (\S+) has tag (\S+)
-    import cliapp, yarnstep
+    IMPLEMENTS THEN git repository (\S+) has tag (\S+), signed with (\S+)
+    import subprocess, cliapp, yarnstep
     dirname = yarnstep.get_next_match_as_datadir_path()
     tagname = yarnstep.get_next_match()
-    output = cliapp.runcmd(['git', 'show', tagname], cwd=dirname)
-    assert output.startswith('tag ' + tagname)
+    keyid = yarnstep.get_next_match()
+    output = cliapp.runcmd(
+        ['git', 'verify-tag', tagname],
+        cwd=dirname,
+        stderr=subprocess.STDOUT)
+    assert keyid in output