Add signoff.py script

Author: laanwj

README.md

@@ -61,3 +61,24 @@ treehash512.py [<commithash>]
 
 This should match the Tree-SHA512 commit metadata field added by
 github-merge.
+
+signoff
+----------
+
+This is an utility to manually add a treehash to the HEAD commit and then
+gpg-sign it. This is useful when there is the need to manually add a commit.
+
+Usage:
+
+```bash
+signoff.py
+```
+(no command line arguments)
+
+When there is already a treehash on the HEAD commit, it is compared against
+what is computed. If this matches, it continues. If the treehash mismatches an
+error is thrown. If there is no treehash it adds the "Tree-SHA512:" header with
+the computed hash to the commit message.
+
+After making sure the treehash is correct it verifies whether the commit is
+signed. If so it just displays the signature, if not, it is signed.

signoff.py

@@ -0,0 +1,38 @@
+#!/usr/bin/python3
+'''
+This is an utility to manually add a treehash to the top commit and
+then gpg-sign it.
+'''
+from treehash512 import tree_sha512sum, GIT
+import subprocess, sys
+HDR = b'Tree-SHA512'
+def main():
+    commit = 'HEAD'
+    h = tree_sha512sum(commit).encode()
+    msg = subprocess.check_output([GIT, 'show', '-s', '--format=%B', commit]).rstrip()
+
+    curh = None
+    for line in msg.splitlines():
+        if line.startswith(HDR+b':'):
+            assert(curh is None) # no multiple treehashes
+            curh = line[len(HDR)+1:].strip()
+
+    if curh == h:
+        print('Warning: already has a (valid) treehash')
+        if subprocess.call([GIT, 'verify-commit', commit]) == 0:
+            # already signed, too, just exit
+            sys.exit(0)
+    elif curh is not None:
+        print('Error: already has a treehash, which mismatches. Something is wrong. Remove it first.')
+        sys.exit(1)
+    else: # no treehash
+        msg += b'\n\n' + HDR + b': ' + h
+
+    print(msg.decode())
+
+    subprocess.check_call([GIT, 'commit', '--amend', '--gpg-sign', '-m', msg, '--no-edit'])
+    rv = subprocess.call([GIT, 'verify-commit', commit])
+    sys.exit(rv)
+
+if __name__ == '__main__':
+    main()