Skip to content

Fix message for signature with 'same_user_different_email' status

Bogdan Denkovych requested to merge clarify-message-about-unverified-signature into master

What does this MR do and why?

Related to https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/2491#note_1004480190

Since https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/2491, GitLab does not link unverified secondary emails with any users. This made an effect on verification status for commit signatures.

So now, when the committer_email belongs to the user as an unconfirmed secondary email, the status of the commit signature will be :other_user instead of :same_user_different_email. See specs https://gitlab.com/gitlab-org/gitlab/-/blob/9bebb8cb4a5cba4f9372b2a682e725b76427281d/spec/features/signed_commits_spec.rb#L86-L117

The message "This commit was signed with a verified signature, but the committer email is not verified to belong to the same user." doesn't reflect :same_user_different_email status.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Bogdan Denkovych

Merge request reports