Git Signing in Python

import hashlib
import hmac

class GPGMock:
    def __init__(self, secret_key):
        self.secret_key = secret_key.encode()

    def sign_commit(self, commit_message):
        """Mock GPG signing by computing an HMAC of the commit message."""
        signature = hmac.new(self.secret_key, commit_message.encode(), hashlib.sha256).hexdigest()
        return f"-----BEGIN PGP SIGNATURE-----\n{signature}\n-----END PGP SIGNATURE-----"

    def verify_commit(self, commit_message, signature):
        """Verify that the signature matches the commit message."""
        expected = self.sign_commit(commit_message)
        return hmac.compare_digest(expected, signature)


if __name__ == "__main__":
    # Example usage
    repo_key = "my-repo-secret-123"
    gpg = GPGMock(repo_key)

    commit_msg = "feat: add user authentication"
    signed = gpg.sign_commit(commit_msg)
    print(f"Commit message: {commit_msg}")
    print(f"Signed output:\n{signed}")

    # Verify
    is_valid = gpg.verify_commit(commit_msg, signed)
    print(f"Signature valid: {is_valid}")

    # Tamper test
    tampered = signed.replace("authentication", "authorization")
    is_valid_tampered = gpg.verify_commit("feat: add user authorization", tampered)
    print(f"Tampered signature valid: {is_valid_tampered}")