GPG verified commits breaks patch package.

[alanxoc3]

Hi! 👋

Firstly, thanks for your work on this project! 🙂

Today I used patch-package to patch patch-package@6.4.7 for the project I'm working on.

I saw that patch-package was broken when the latest commit is a gpg verified commit. This fixes it and to the extent of my knowledge, shouldn't have any negative side effects unless someone is using a very old version of git maybe. I used patch-package to fix patch-package, so that's fun too.

Here is the diff that solved my problem:

diff --git a/node_modules/patch-package/dist/makePatch.js b/node_modules/patch-package/dist/makePatch.js
index 985589e..4a5f296 100644
--- a/node_modules/patch-package/dist/makePatch.js
+++ b/node_modules/patch-package/dist/makePatch.js
@@ -120,7 +120,7 @@ function makePatch({ packagePathSpecifier, appPath, packageManager, includePaths
         // remove ignored files first
         filterFiles_1.removeIgnoredFiles(tmpRepoPackagePath, includePaths, excludePaths);
         git("add", "-f", packageDetails.path);
-        git("commit", "--allow-empty", "-m", "init");
+        git("commit", "--no-gpg-sign", "--allow-empty", "-m", "init");
         // replace package with user's version
         rimraf_1.sync(tmpRepoPackagePath);
         // pnpm installs packages as symlinks, copySync would copy only the symlink

This is the error message I was seeing:

patch-package 6.4.7
• Creating temporary folder
• Installing @ajsf/core@0.4.0-beta.2 with npm
• Diffing your files with clean files
error: gpg failed to sign the data
fatal: failed to write commit object

This would only appear to people who have this in their ~/.config/git/config file:

[commit]
    gpgsign = true

This issue body was partially generated by patch-package.

[jrolfs]

Just ran into this as well. Haha, now if only we could save this as a patch and apply that patch on every install 🤔...

I used patch-package to fix patch-package, so that's fun too.

... 🥁

On a more serious note, thanks for the heads up @alanxoc3. @ds300 this seems like a safe change to implement as the default behavior?

[alanxoc3]

Lol. I actually had some success using patch package to auto-patch itself, but it didn't work on our CI servers, so I'm just disabling gpg for now.

[simon-abbott]

@ds300 any movement on this? It's really annoying to have to turn gpgsign on and off every time I create a new patch.

[jamesbirtles]

For my own future reference, this is quite a good way of getting around this temporarily:

GIT_CONFIG_GLOBAL=/dev/null npx patch-package thing-to-patch