signing: allow specifying sign behavior

CHANGELOG.md

···
   `split.legacy-bookmark-behavior = true`, but this will likely be removed in a
   future release. [#3419](https://github.com/jj-vcs/jj/issues/3419)
 
+* The `signing.sign-all` config option has been deprecated in favor of
+  `signing.behavior`. The new option accepts `drop` (never sign), `keep` (preserve
+  existing signatures), `own` (sign own commits), or `force` (sign all commits).
+  Existing `signing.sign-all = true` translates to `signing.behavior = "own"`, and
+  `false` translates to `"keep"`.
+
 
 ### New features
 

cli/src/config-schema.json

···
                     "type": "string",
                     "description": "The key the configured signing backend will use to to sign commits. Overridden by `jj sign` parameter or by the global `--sign-with` option"
                 },
-                "sign-all": {
-                    "type": "boolean",
-                    "description": "Whether to sign all commits by default. Overridden by global `--no-sign` option",
-                    "default": false
+                "behavior": {
+                    "type": "string",
+                    "enum": ["drop", "keep", "own", "force"],
+                    "description": "Which commits to sign by default. Values: drop (never sign), keep (preserve existing signatures), own (sign own commits), force (sign all commits)"
                 },
                 "backends": {
                     "type": "object",

cli/src/config.rs

···
         ConfigMigrationRule::rename_value("git.auto-local-branch", "git.auto-local-bookmark"),
         // TODO: Delete in jj 0.28+
         ConfigMigrationRule::rename_value("git.push-branch-prefix", "git.push-bookmark-prefix"),
+        // TODO: Delete in jj 0.33+
+        ConfigMigrationRule::rename_update_value(
+            "signing.sign-all",
+            "signing.behavior",
+            |old_value| {
+                if old_value
+                    .as_bool()
+                    .ok_or("signing.sign-all expects a boolean")?
+                {
+                    Ok("own".into())
+                } else {
+                    Ok("keep".into())
+                }
+            },
+        ),
     ]
 }
 

cli/tests/test_commit_template.rs

···
     let repo_path = test_env.env_root().join("repo");
 
     test_env.jj_cmd_ok(&repo_path, &["commit", "-m", "unsigned"]);
-    test_env.add_config("signing.sign-all = true");
+    test_env.add_config("signing.behavior = 'own'");
     test_env.add_config("signing.backend = 'test'");
     test_env.jj_cmd_ok(&repo_path, &["describe", "-m", "signed"]);
 

cli/tests/test_completion.rs

···
     );
     insta::assert_snapshot!(stdout, @"ui.conflict-marker-style=git");
 
-    let stdout =
-        test_env.jj_cmd_success(dir, &["--", "jj", "log", "--config", "signing.sign-all="]);
+    let stdout = test_env.jj_cmd_success(
+        dir,
+        &[
+            "--",
+            "jj",
+            "log",
+            "--config",
+            "git.abandon-unreachable-commits=",
+        ],
+    );
     insta::assert_snapshot!(stdout, @r"
-    signing.sign-all=false
-    signing.sign-all=true
+    git.abandon-unreachable-commits=false
+    git.abandon-unreachable-commits=true
     ");
 }
 

docs/config.md

···
 
 ```toml
 [signing]
-sign-all = true
+behavior = "own"
 backend = "gpg"
 key = "4ED556E9729E000F"
 ## You can set `key` to anything accepted by `gpg -u`
···
 
 ```toml
 [signing]
-sign-all = true
+behavior = "own"
 backend = "ssh"
 key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGj+J6N6SO+4P8dOZqfR1oiay2yxhhHnagH52avUqw5h"
 ## You can also use a path instead of embedding the key
···
 
 ### Sign commits only on `jj git push`
 
-Instead of signing all commits during creation when `signing.sign-all` is
-set to `true`, the `git.sign-on-push` configuration can be used to sign
+Instead of signing all commits during creation when `signing.behavior` is
+set to `own`, the `git.sign-on-push` configuration can be used to sign
 commits only upon running `jj git push`. All mutable unsigned commits
 being pushed will be signed prior to pushing. This might be preferred if the
 signing backend requires user interaction or is slow, so that signing is
 performed in a single batch operation.
 
 ```toml
-# Configure signing backend as before, without setting `signing.sign-all`
+# Configure signing backend as before, but lazily signing only on push.
 [signing]
+behavior = "drop"
 backend = "ssh"
 key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGj+J6N6SO+4P8dOZqfR1oiay2yxhhHnagH52avUqw5h"
 

lib/src/settings.rs

···
 impl SignSettings {
     /// Load the signing settings from the config.
     pub fn from_settings(settings: &UserSettings) -> Self {
-        let sign_all = settings.get_bool("signing.sign-all").unwrap_or(false);
+        let behavior = settings
+            .get("signing.behavior")
+            .unwrap_or(SignBehavior::Keep);
+
         Self {
-            behavior: if sign_all {
-                SignBehavior::Own
-            } else {
-                SignBehavior::Keep
-            },
+            behavior,
             user_email: settings.user_email().to_owned(),
             key: settings.get_string("signing.key").ok(),
         }

lib/src/signing.rs

···
 }
 
 /// A enum that describes if a created/rewritten commit should be signed or not.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Deserialize)]
+#[serde(rename_all = "kebab-case")]
 pub enum SignBehavior {
     /// Drop existing signatures.
     /// This is what jj did before signing support or does now when a signing

lib/tests/test_signing.rs

···
 use testutils::TestRepoBackend;
 use testutils::TestWorkspace;
 
-fn user_settings(sign_all: bool) -> UserSettings {
+fn user_settings(behavior: SignBehavior) -> UserSettings {
     let mut config = testutils::base_user_config();
     config.add_layer(
         ConfigLayer::parse(
···
             &format!(
                 r#"
                 signing.key = "impeccable"
-                signing.sign-all = {sign_all}
-                "#
+                signing.behavior = "{}"
+                "#,
+                match behavior {
+                    SignBehavior::Drop => "drop",
+                    SignBehavior::Keep => "keep",
+                    SignBehavior::Own => "own",
+                    SignBehavior::Force => "force",
+                }
             ),
         )
         .unwrap(),
···
 #[test_case(TestRepoBackend::Local ; "local backend")]
 #[test_case(TestRepoBackend::Git ; "git backend")]
 fn manual(backend: TestRepoBackend) {
-    let settings = user_settings(true);
+    let settings = user_settings(SignBehavior::Own);
 
     let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
     let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
···
 
 #[test_case(TestRepoBackend::Git ; "git backend")]
 fn keep_on_rewrite(backend: TestRepoBackend) {
-    let settings = user_settings(true);
+    let settings = user_settings(SignBehavior::Own);
 
     let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
     let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
···
 
 #[test_case(TestRepoBackend::Git ; "git backend")]
 fn manual_drop_on_rewrite(backend: TestRepoBackend) {
-    let settings = user_settings(true);
+    let settings = user_settings(SignBehavior::Own);
 
     let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
     let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
···
 
 #[test_case(TestRepoBackend::Git ; "git backend")]
 fn forced(backend: TestRepoBackend) {
-    let settings = user_settings(true);
+    let settings = user_settings(SignBehavior::Force);
 
     let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
     let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
···
     let repo = repo.clone();
     let mut tx = repo.start_transaction();
     let commit = create_random_commit(tx.repo_mut())
-        .set_sign_behavior(SignBehavior::Force)
         .set_author(someone_else())
         .write()
         .unwrap();
···
 
 #[test_case(TestRepoBackend::Git ; "git backend")]
 fn configured(backend: TestRepoBackend) {
-    let settings = user_settings(true);
+    let settings = user_settings(SignBehavior::Own);
 
     let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
     let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
···
     let commit = repo.store().get_commit(commit.id()).unwrap();
     assert_eq!(commit.verification().unwrap(), good_verification());
 }
+
+#[test_case(TestRepoBackend::Git ; "git backend")]
+fn drop_behavior(backend: TestRepoBackend) {
+    let settings = user_settings(SignBehavior::Drop);
+
+    let signer = Signer::new(Some(Box::new(TestSigningBackend)), vec![]);
+    let test_workspace = TestWorkspace::init_with_backend_and_signer(backend, signer, &settings);
+
+    let repo = &test_workspace.repo;
+
+    let repo = repo.clone();
+    let mut tx = repo.start_transaction();
+    let commit = create_random_commit(tx.repo_mut())
+        .set_sign_behavior(SignBehavior::Own)
+        .write()
+        .unwrap();
+    tx.commit("test").unwrap();
+
+    let original_commit = repo.store().get_commit(commit.id()).unwrap();
+    assert_eq!(original_commit.verification().unwrap(), good_verification());
+
+    let mut tx = repo.start_transaction();
+    let mut_repo = tx.repo_mut();
+    let rewritten = mut_repo.rewrite_commit(&original_commit).write().unwrap();
+
+    let rewritten_commit = repo.store().get_commit(rewritten.id()).unwrap();
+    assert_eq!(rewritten_commit.verification().unwrap(), None);
+}