Add --no-show-signature where git supports it, fixes #8966

src/Composer/Downloader/GitDownloader.php

@@ -48,7 +48,7 @@ class GitDownloader extends VcsDownloader implements DvcsDownloaderInterface
         $flag = Platform::isWindows() ? '/D ' : '';
 
         // --dissociate option is only available since git 2.3.0-rc0
-        $gitVersion = $this->gitUtil->getVersion();
+        $gitVersion = GitUtil::getVersion($this->process);
         $msg = "Cloning ".$this->getShortHash($ref);
 
         $command = 'git clone --no-checkout %url% %path% && cd '.$flag.'%path% && git remote add composer %url% && git fetch composer && git remote set-url origin %sanitizedUrl% && git remote set-url composer %sanitizedUrl%';
@@ -435,7 +435,7 @@ class GitDownloader extends VcsDownloader implements DvcsDownloaderInterface
     protected function getCommitLogs($fromReference, $toReference, $path)
     {
         $path = $this->normalizePath($path);
-        $command = sprintf('git log %s..%s --pretty=format:"%%h - %%an: %%s"', ProcessExecutor::escape($fromReference), ProcessExecutor::escape($toReference));
+        $command = sprintf('git log %s..%s --pretty=format:"%%h - %%an: %%s"'.GitUtil::getNoShowSignatureFlag($this->process), ProcessExecutor::escape($fromReference), ProcessExecutor::escape($toReference));
 
         if (0 !== $this->process->execute($command, $output, $path)) {
             throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());

src/Composer/Package/Locker.php

@@ -422,7 +422,7 @@ class Locker
                 case 'git':
                     GitUtil::cleanEnv();
 
-                    if (0 === $this->process->execute('git log -n1 --pretty=%ct '.ProcessExecutor::escape($sourceRef), $output, $path) && preg_match('{^\s*\d+\s*$}', $output)) {
+                    if (0 === $this->process->execute('git log -n1 --pretty=%ct '.ProcessExecutor::escape($sourceRef).GitUtil::getNoShowSignatureFlag($this->process), $output, $path) && preg_match('{^\s*\d+\s*$}', $output)) {
                         $datetime = new \DateTime('@'.trim($output), new \DateTimeZone('UTC'));
                     }
                     break;

src/Composer/Package/Version/VersionGuesser.php

@@ -169,7 +169,7 @@ class VersionGuesser
         }
 
         if (!$commit) {
-            $command = 'git log --pretty="%H" -n1 HEAD';
+            $command = 'git log --pretty="%H" -n1 HEAD'.GitUtil::getNoShowSignatureFlag($this->process);
             if (0 === $this->process->execute($command, $output, $path)) {
                 $commit = trim($output) ?: null;
             }

src/Composer/Repository/PathRepository.php

@@ -21,6 +21,7 @@ use Composer\Package\Version\VersionParser;
 use Composer\Util\Platform;
 use Composer\Util\ProcessExecutor;
 use Composer\Util\Filesystem;
+use Composer\Util\Git as GitUtil;
 
 /**
  * This repository allows installing local packages that are not necessarily under their own VCS.
@@ -176,7 +177,7 @@ class PathRepository extends ArrayRepository implements ConfigurableRepositoryIn
             }
 
             $output = '';
-            if (is_dir($path . DIRECTORY_SEPARATOR . '.git') && 0 === $this->process->execute('git log -n1 --pretty=%H', $output, $path)) {
+            if (is_dir($path . DIRECTORY_SEPARATOR . '.git') && 0 === $this->process->execute('git log -n1 --pretty=%H'.GitUtil::getNoShowSignatureFlag($this->process), $output, $path)) {
                 $package['dist']['reference'] = trim($output);
             }
 

src/Composer/Util/Git.php

@@ -20,7 +20,7 @@ use Composer\IO\IOInterface;
  */
 class Git
 {
-    private static $version;
+    private static $version = false;
 
     /** @var IOInterface */
     protected $io;
@@ -291,6 +291,16 @@ class Git
         return false;
     }
 
+    public static function getNoShowSignatureFlag(ProcessExecutor $process)
+    {
+        $gitVersion = self::getVersion($process);
+        if ($gitVersion && version_compare($gitVersion, '2.10.0-rc0', '>=')) {
+            return ' --no-show-signature';
+        }
+
+        return '';
+    }
+
     private function checkRefIsInMirror($url, $dir, $ref)
     {
         if (is_dir($dir) && 0 === $this->process->execute('git rev-parse --git-dir', $output, $dir) && trim($output) === '.') {
@@ -398,16 +408,18 @@ class Git
      *
      * @return string|null The git version number.
      */
-    public function getVersion()
+    public static function getVersion(ProcessExecutor $process = null)
     {
-        if (isset(self::$version)) {
+        if (false === self::$version) {
-            return self::$version;
+            self::$version = null;
-        }
+            if (!$process) {
-        if (0 !== $this->process->execute('git --version', $output)) {
+                $process = new ProcessExecutor;
-            return;
+            }
-        }
+            if (0 === $process->execute('git --version', $output) && preg_match('/^git version (\d+(?:\.\d+)+)/m', $output, $matches)) {
-        if (preg_match('/^git version (\d+(?:\.\d+)+)/m', $output, $matches)) {
+                self::$version = $matches[1];
-            return self::$version = $matches[1];
+            }
         }
+
+        return self::$version;
     }
 }

tests/Composer/Test/Package/Version/VersionGuesserTest.php

@@ -16,6 +16,7 @@ use Composer\Config;
 use Composer\Package\Version\VersionGuesser;
 use Composer\Semver\VersionParser;
 use Composer\Test\TestCase;
+use Composer\Util\Git as GitUtil;
 
 class VersionGuesserTest extends TestCase
 {
@@ -66,7 +67,18 @@ class VersionGuesserTest extends TestCase
             ->expects($this->at($step))
             ->method('execute')
             ->willReturnCallback(function ($command, &$output) use ($self) {
-                $self->assertEquals('git log --pretty="%H" -n1 HEAD', $command);
+                $self->assertEquals('git --version', $command);
+
+                return 0;
+            })
+        ;
+
+        ++$step;
+        $executor
+            ->expects($this->at($step))
+            ->method('execute')
+            ->willReturnCallback(function ($command, &$output) use ($self, $executor) {
+                $self->assertEquals('git log --pretty="%H" -n1 HEAD'.GitUtil::getNoShowSignatureFlag($executor), $command);
 
                 return 128;
             })