verify_git_commit_sig.bash

#!/usr/bin/env bash
trusted_keys=(                                              #A
    "E60892BB9BD89A69F759A1A0A3D652173B763E8F"              #A
    "CA84AA8BF9EBBE8AAD3EF759A1A652173B768B35"              #A
)
exit_code=0
for hash in $(git log --format=format:%H --no-merges); do   #B
    res=$(git verify-commit --raw $hash 2>&1)
    if [ $? -gt 0 ]; then
        echo $hash NO SIGNATURE FOUND
        exit_code=1
        continue
    fi
    author="$(echo $res | grep -Po 'VALIDSIG [0-9A-F]{40}' \
        |cut -d ' ' -f2)"
    is_trusted=0
    case "${trusted_keys[@]}" in                             #C
        *"$author"*) is_trusted=1                            #C
    ;; esac                                                  #C
    if [ $is_trusted -eq 1 ]; then
        echo "$hash TRUSTED $(gpg --fingerprint $author \
            |grep uid |head -1|awk '{print $2,$3,$4,$5}')"
    else
        echo $hash SIGNATURE AUTHOR NOT TRUSTED: $author
        exit_code=1
    fi
done
exit $exit_code