Merge pull request #11219 from Erethon/devel

ansible-pull: Add option to verify gpg signature of a commit

lib/ansible/cli/pull.py

@@ -70,7 +70,9 @@ class PullCLI(CLI):
             help='adds the hostkey for the repo url if not already added')
         self.parser.add_option('-m', '--module-name', dest='module_name', default=self.DEFAULT_REPO_TYPE,
             help='Repository module name, which ansible will use to check out the repo. Default is %s.' % self.DEFAULT_REPO_TYPE)
-
+        self.parser.add_option('--verify-commit', dest='verify', default=False, action='store_true',
+            help='verify GPG signature of checked out commit, if it fails abort running the playbook.'
+                 ' This needs the corresponding VCS module to support such an operation')
 
         self.options, self.args = self.parser.parse_args()
 
@@ -127,6 +129,9 @@ class PullCLI(CLI):
             if self.options.private_key_file:
                 repo_opts += ' key_file=%s' % self.options.private_key_file
 
+            if self.options.verify:
+                repo_opts += ' verify_commit=yes'
+
         path = module_loader.find_plugin(self.options.module_name)
         if path is None:
             raise AnsibleOptionsError(("module '%s' not found.\n" % self.options.module_name))