2011-10-20 02:15:05 +02:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
|
|
test_description='signed commit tests'
|
|
|
|
|
. ./test-lib.sh
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
GNUPGHOME_NOT_USED=$GNUPGHOME
|
2011-10-20 02:15:05 +02:00
|
|
|
. "$TEST_DIRECTORY/lib-gpg.sh"
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'create signed commits' '
|
2020-02-22 21:17:42 +01:00
|
|
|
test_oid_cache <<-\EOF &&
|
|
|
|
|
header sha1:gpgsig
|
|
|
|
|
header sha256:gpgsig-sha256
|
|
|
|
|
EOF
|
|
|
|
|
|
2013-12-16 14:55:04 +01:00
|
|
|
test_when_finished "test_unconfig commit.gpgsign" &&
|
|
|
|
|
|
2011-10-20 02:15:05 +02:00
|
|
|
echo 1 >file && git add file &&
|
|
|
|
|
test_tick && git commit -S -m initial &&
|
|
|
|
|
git tag initial &&
|
|
|
|
|
git branch side &&
|
|
|
|
|
|
|
|
|
|
echo 2 >file && test_tick && git commit -a -S -m second &&
|
|
|
|
|
git tag second &&
|
|
|
|
|
|
|
|
|
|
git checkout side &&
|
|
|
|
|
echo 3 >elif && git add elif &&
|
|
|
|
|
test_tick && git commit -m "third on side" &&
|
|
|
|
|
|
|
|
|
|
git checkout master &&
|
|
|
|
|
test_tick && git merge -S side &&
|
|
|
|
|
git tag merge &&
|
|
|
|
|
|
|
|
|
|
echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
|
|
|
|
|
git tag fourth-unsigned &&
|
|
|
|
|
|
2012-01-05 19:54:14 +01:00
|
|
|
test_tick && git commit --amend -S -m "fourth signed" &&
|
2013-12-16 14:55:04 +01:00
|
|
|
git tag fourth-signed &&
|
|
|
|
|
|
|
|
|
|
git config commit.gpgsign true &&
|
|
|
|
|
echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
|
|
|
|
|
git tag fifth-signed &&
|
|
|
|
|
|
|
|
|
|
git config commit.gpgsign false &&
|
|
|
|
|
echo 6 >file && test_tick && git commit -a -m "sixth" &&
|
|
|
|
|
git tag sixth-unsigned &&
|
|
|
|
|
|
|
|
|
|
git config commit.gpgsign true &&
|
|
|
|
|
echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
|
|
|
|
|
git tag seventh-unsigned &&
|
|
|
|
|
|
|
|
|
|
test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
|
2015-03-20 11:07:15 +01:00
|
|
|
git tag seventh-signed &&
|
2014-06-17 02:05:54 +02:00
|
|
|
|
|
|
|
|
echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
|
2016-05-02 23:58:45 +02:00
|
|
|
git tag eighth-signed-alt &&
|
|
|
|
|
|
|
|
|
|
# commit.gpgsign is still on but this must not be signed
|
t7510: invoke git as part of &&-chain
If `git commit-tree HEAD^{tree}` fails on us and produces no output on
stdout, we will substitute that empty string and execute `git tag
ninth-unsigned`, i.e., we will tag HEAD rather than a newly created
object. But we are lucky: we have a signature on HEAD, so we should
eventually fail the next test, where we verify that "ninth-unsigned" is
indeed unsigned.
We have a similar problem a few lines later. If `git commit-tree -S`
fails with no output, we will happily tag HEAD as "tenth-signed". Here,
we are not so lucky. The tag ends up on the same commit as
"eighth-signed-alt", and that's a signed commit, so t7510-signed-commit
will pass, despite `git commit-tree -S` failing.
Make these `git commit-tree` invocations a direct part of the &&-chain,
so that we can rely less on luck and set a better example for future
tests modeled after this one. Fix a 9/10 copy/paste error while at it.
Signed-off-by: Martin Ågren <martin.agren@gmail.com>
Signed-off-by: Brandon Richardson <brandon1024.br@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-01-20 00:23:33 +01:00
|
|
|
echo 9 | git commit-tree HEAD^{tree} >oid &&
|
|
|
|
|
test_line_count = 1 oid &&
|
|
|
|
|
git tag ninth-unsigned $(cat oid) &&
|
2016-05-02 23:58:45 +02:00
|
|
|
# explicit -S of course must sign.
|
t7510: invoke git as part of &&-chain
If `git commit-tree HEAD^{tree}` fails on us and produces no output on
stdout, we will substitute that empty string and execute `git tag
ninth-unsigned`, i.e., we will tag HEAD rather than a newly created
object. But we are lucky: we have a signature on HEAD, so we should
eventually fail the next test, where we verify that "ninth-unsigned" is
indeed unsigned.
We have a similar problem a few lines later. If `git commit-tree -S`
fails with no output, we will happily tag HEAD as "tenth-signed". Here,
we are not so lucky. The tag ends up on the same commit as
"eighth-signed-alt", and that's a signed commit, so t7510-signed-commit
will pass, despite `git commit-tree -S` failing.
Make these `git commit-tree` invocations a direct part of the &&-chain,
so that we can rely less on luck and set a better example for future
tests modeled after this one. Fix a 9/10 copy/paste error while at it.
Signed-off-by: Martin Ågren <martin.agren@gmail.com>
Signed-off-by: Brandon Richardson <brandon1024.br@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-01-20 00:23:33 +01:00
|
|
|
echo 10 | git commit-tree -S HEAD^{tree} >oid &&
|
|
|
|
|
test_line_count = 1 oid &&
|
2019-01-20 00:23:34 +01:00
|
|
|
git tag tenth-signed $(cat oid) &&
|
|
|
|
|
|
|
|
|
|
# --gpg-sign[=<key-id>] must sign.
|
|
|
|
|
echo 11 | git commit-tree --gpg-sign HEAD^{tree} >oid &&
|
|
|
|
|
test_line_count = 1 oid &&
|
|
|
|
|
git tag eleventh-signed $(cat oid) &&
|
|
|
|
|
echo 12 | git commit-tree --gpg-sign=B7227189 HEAD^{tree} >oid &&
|
|
|
|
|
test_line_count = 1 oid &&
|
|
|
|
|
git tag twelfth-signed-alt $(cat oid)
|
2011-10-20 02:15:05 +02:00
|
|
|
'
|
|
|
|
|
|
2014-06-23 09:05:51 +02:00
|
|
|
test_expect_success GPG 'verify and show signatures' '
|
2011-10-20 02:15:05 +02:00
|
|
|
(
|
2016-05-02 23:58:45 +02:00
|
|
|
for commit in initial second merge fourth-signed \
|
2019-01-20 00:23:34 +01:00
|
|
|
fifth-signed sixth-signed seventh-signed tenth-signed \
|
|
|
|
|
eleventh-signed
|
2011-10-20 02:15:05 +02:00
|
|
|
do
|
2014-06-23 09:05:51 +02:00
|
|
|
git verify-commit $commit &&
|
2011-10-20 02:15:05 +02:00
|
|
|
git show --pretty=short --show-signature $commit >actual &&
|
t7510: use consistent &&-chains in loop
We check multiple commits in a loop. Because we want to
break out of the loop if any single iteration fails, we use
a subshell/exit like:
(
for i in $stuff
do
do-something $i || exit 1
done
)
However, we are inconsistent in our loop body. Some commands
get their own "|| exit 1", and others try to chain to the
next command with "&&", like:
X &&
Y || exit 1
Z || exit 1
This is a little hard to read and follow, because X and Y
are treated differently for no good reason. But much worse,
the second loop follows a similar pattern and gets it wrong.
"Y" is expected to fail, so we use "&& exit 1", giving us:
X &&
Y && exit 1
Z || exit 1
That gets the test for X wrong (we do not exit unless both X
fails and Y unexpectedly succeeds, but we would want to exit
if _either_ is wrong). We can write this clearly and
correctly by consistently using "&&", followed by a single
"|| exit 1", and negating Y with "!" (as we would in a
normal &&-chain). Like:
X &&
! Y &&
Z || exit 1
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-06-17 02:03:43 +02:00
|
|
|
grep "Good signature from" actual &&
|
|
|
|
|
! grep "BAD signature from" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
2011-10-20 02:15:05 +02:00
|
|
|
done
|
|
|
|
|
) &&
|
|
|
|
|
(
|
2016-05-02 23:58:45 +02:00
|
|
|
for commit in merge^2 fourth-unsigned sixth-unsigned \
|
|
|
|
|
seventh-unsigned ninth-unsigned
|
2011-10-20 02:15:05 +02:00
|
|
|
do
|
2014-06-23 09:05:51 +02:00
|
|
|
test_must_fail git verify-commit $commit &&
|
2011-10-20 02:15:05 +02:00
|
|
|
git show --pretty=short --show-signature $commit >actual &&
|
t7510: use consistent &&-chains in loop
We check multiple commits in a loop. Because we want to
break out of the loop if any single iteration fails, we use
a subshell/exit like:
(
for i in $stuff
do
do-something $i || exit 1
done
)
However, we are inconsistent in our loop body. Some commands
get their own "|| exit 1", and others try to chain to the
next command with "&&", like:
X &&
Y || exit 1
Z || exit 1
This is a little hard to read and follow, because X and Y
are treated differently for no good reason. But much worse,
the second loop follows a similar pattern and gets it wrong.
"Y" is expected to fail, so we use "&& exit 1", giving us:
X &&
Y && exit 1
Z || exit 1
That gets the test for X wrong (we do not exit unless both X
fails and Y unexpectedly succeeds, but we would want to exit
if _either_ is wrong). We can write this clearly and
correctly by consistently using "&&", followed by a single
"|| exit 1", and negating Y with "!" (as we would in a
normal &&-chain). Like:
X &&
! Y &&
Z || exit 1
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2014-06-17 02:03:43 +02:00
|
|
|
! grep "Good signature from" actual &&
|
|
|
|
|
! grep "BAD signature from" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
2014-06-17 02:05:54 +02:00
|
|
|
done
|
|
|
|
|
) &&
|
|
|
|
|
(
|
2019-01-20 00:23:34 +01:00
|
|
|
for commit in eighth-signed-alt twelfth-signed-alt
|
2014-06-17 02:05:54 +02:00
|
|
|
do
|
|
|
|
|
git show --pretty=short --show-signature $commit >actual &&
|
|
|
|
|
grep "Good signature from" actual &&
|
|
|
|
|
! grep "BAD signature from" actual &&
|
|
|
|
|
grep "not certified" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
2011-10-20 02:15:05 +02:00
|
|
|
done
|
|
|
|
|
)
|
|
|
|
|
'
|
|
|
|
|
|
2015-06-22 01:14:40 +02:00
|
|
|
test_expect_success GPG 'verify-commit exits success on untrusted signature' '
|
2015-06-22 01:14:39 +02:00
|
|
|
git verify-commit eighth-signed-alt 2>actual &&
|
|
|
|
|
grep "Good signature from" actual &&
|
|
|
|
|
! grep "BAD signature from" actual &&
|
|
|
|
|
grep "not certified" actual
|
|
|
|
|
'
|
|
|
|
|
|
gpg-interface: add minTrustLevel as a configuration option
Previously, signature verification for merge and pull operations checked
if the key had a trust-level of either TRUST_NEVER or TRUST_UNDEFINED in
verify_merge_signature(). If that was the case, the process die()d.
The other code paths that did signature verification relied entirely on
the return code from check_commit_signature(). And signatures made with
a good key, irregardless of its trust level, was considered valid by
check_commit_signature().
This difference in behavior might induce users to erroneously assume
that the trust level of a key in their keyring is always considered by
Git, even for operations where it is not (e.g. during a verify-commit or
verify-tag).
The way it worked was by gpg-interface.c storing the result from the
key/signature status *and* the lowest-two trust levels in the `result`
member of the signature_check structure (the last of these status lines
that were encountered got written to `result`). These are documented in
GPG under the subsection `General status codes` and `Key related`,
respectively [1].
The GPG documentation says the following on the TRUST_ status codes [1]:
"""
These are several similar status codes:
- TRUST_UNDEFINED <error_token>
- TRUST_NEVER <error_token>
- TRUST_MARGINAL [0 [<validation_model>]]
- TRUST_FULLY [0 [<validation_model>]]
- TRUST_ULTIMATE [0 [<validation_model>]]
For good signatures one of these status lines are emitted to
indicate the validity of the key used to create the signature.
The error token values are currently only emitted by gpgsm.
"""
My interpretation is that the trust level is conceptionally different
from the validity of the key and/or signature. That seems to also have
been the assumption of the old code in check_signature() where a result
of 'G' (as in GOODSIG) and 'U' (as in TRUST_NEVER or TRUST_UNDEFINED)
were both considered a success.
The two cases where a result of 'U' had special meaning were in
verify_merge_signature() (where this caused git to die()) and in
format_commit_one() (where it affected the output of the %G? format
specifier).
I think it makes sense to refactor the processing of TRUST_ status lines
such that users can configure a minimum trust level that is enforced
globally, rather than have individual parts of git (e.g. merge) do it
themselves (except for a grace period with backward compatibility).
I also think it makes sense to not store the trust level in the same
struct member as the key/signature status. While the presence of a
TRUST_ status code does imply that the signature is good (see the first
paragraph in the included snippet above), as far as I can tell, the
order of the status lines from GPG isn't well-defined; thus it would
seem plausible that the trust level could be overwritten with the
key/signature status if they were stored in the same member of the
signature_check structure.
This patch introduces a new configuration option: gpg.minTrustLevel. It
consolidates trust-level verification to gpg-interface.c and adds a new
`trust_level` member to the signature_check structure.
Backward-compatibility is maintained by introducing a special case in
verify_merge_signature() such that if no user-configurable
gpg.minTrustLevel is set, then the old behavior of rejecting
TRUST_UNDEFINED and TRUST_NEVER is enforced. If, on the other hand,
gpg.minTrustLevel is set, then that value overrides the old behavior.
Similarly, the %G? format specifier will continue show 'U' for
signatures made with a key that has a trust level of TRUST_UNDEFINED or
TRUST_NEVER, even though the 'U' character no longer exist in the
`result` member of the signature_check structure. A new format
specifier, %GT, is also introduced for users that want to show all
possible trust levels for a signature.
Another approach would have been to simply drop the trust-level
requirement in verify_merge_signature(). This would also have made the
behavior consistent with other parts of git that perform signature
verification. However, requiring a minimum trust level for signing keys
does seem to have a real-world use-case. For example, the build system
used by the Qubes OS project currently parses the raw output from
verify-tag in order to assert a minimum trust level for keys used to
sign git tags [2].
[1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/doc/DETAILS;h=bd00006e933ac56719b1edd2478ecd79273eae72;hb=refs/heads/master
[2] https://github.com/QubesOS/qubes-builder/blob/9674c1991deef45b1a1b1c71fddfab14ba50dccf/scripts/verify-git-tag#L43
Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-12-27 14:55:57 +01:00
|
|
|
test_expect_success GPG 'verify-commit exits success with matching minTrustLevel' '
|
|
|
|
|
test_config gpg.minTrustLevel ultimate &&
|
|
|
|
|
git verify-commit sixth-signed
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'verify-commit exits success with low minTrustLevel' '
|
|
|
|
|
test_config gpg.minTrustLevel fully &&
|
|
|
|
|
git verify-commit sixth-signed
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'verify-commit exits failure with high minTrustLevel' '
|
|
|
|
|
test_config gpg.minTrustLevel ultimate &&
|
|
|
|
|
test_must_fail git verify-commit eighth-signed-alt
|
|
|
|
|
'
|
|
|
|
|
|
2015-06-22 01:14:42 +02:00
|
|
|
test_expect_success GPG 'verify signatures with --raw' '
|
|
|
|
|
(
|
|
|
|
|
for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
|
|
|
|
|
do
|
|
|
|
|
git verify-commit --raw $commit 2>actual &&
|
|
|
|
|
grep "GOODSIG" actual &&
|
|
|
|
|
! grep "BADSIG" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
|
|
|
|
done
|
|
|
|
|
) &&
|
|
|
|
|
(
|
|
|
|
|
for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
|
|
|
|
|
do
|
|
|
|
|
test_must_fail git verify-commit --raw $commit 2>actual &&
|
|
|
|
|
! grep "GOODSIG" actual &&
|
|
|
|
|
! grep "BADSIG" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
|
|
|
|
done
|
|
|
|
|
) &&
|
|
|
|
|
(
|
|
|
|
|
for commit in eighth-signed-alt
|
|
|
|
|
do
|
|
|
|
|
git verify-commit --raw $commit 2>actual &&
|
|
|
|
|
grep "GOODSIG" actual &&
|
|
|
|
|
! grep "BADSIG" actual &&
|
|
|
|
|
grep "TRUST_UNDEFINED" actual &&
|
|
|
|
|
echo $commit OK || exit 1
|
|
|
|
|
done
|
|
|
|
|
)
|
|
|
|
|
'
|
|
|
|
|
|
2020-02-22 21:17:42 +01:00
|
|
|
test_expect_success GPG 'proper header is used for hash algorithm' '
|
|
|
|
|
git cat-file commit fourth-signed >output &&
|
|
|
|
|
grep "^$(test_oid header) -----BEGIN PGP SIGNATURE-----" output
|
|
|
|
|
'
|
|
|
|
|
|
2014-06-23 09:05:51 +02:00
|
|
|
test_expect_success GPG 'show signed commit with signature' '
|
|
|
|
|
git show -s initial >commit &&
|
|
|
|
|
git show -s --show-signature initial >show &&
|
|
|
|
|
git verify-commit -v initial >verify.1 2>verify.2 &&
|
|
|
|
|
git cat-file commit initial >cat &&
|
2015-03-09 21:03:01 +01:00
|
|
|
grep -v -e "gpg: " -e "Warning: " show >show.commit &&
|
|
|
|
|
grep -e "gpg: " -e "Warning: " show >show.gpg &&
|
2020-02-22 21:17:42 +01:00
|
|
|
grep -v "^ " cat | grep -v "^$(test_oid header) " >cat.commit &&
|
2014-06-23 09:05:51 +02:00
|
|
|
test_cmp show.commit commit &&
|
|
|
|
|
test_cmp show.gpg verify.2 &&
|
|
|
|
|
test_cmp cat.commit verify.1
|
|
|
|
|
'
|
|
|
|
|
|
2011-10-20 02:15:05 +02:00
|
|
|
test_expect_success GPG 'detect fudged signature' '
|
2014-06-17 01:59:59 +02:00
|
|
|
git cat-file commit seventh-signed >raw &&
|
tests: make forging GPG signed commits and tags more robust
A couple of test scripts create forged GPG signed commits or tags to
check that such forgery can't fool various git commands' signature
verification. All but one of those test scripts are prone to
occasional failures because the forgery creates a bogus GPG signature,
and git commands error out with an unexpected error message, e.g.
"Commit deadbeef does not have a GPG signature" instead of "... has a
bad GPG signature".
't5573-pull-verify-signatures.sh', 't7510-signed-commit.sh' and
't7612-merge-verify-signatures.sh' create forged signed commits like
this:
git commit -S -m "bad on side" &&
git cat-file commit side-bad >raw &&
sed -e "s/bad/forged bad/" raw >forged &&
git hash-object -w -t commit forged >forged.commit
On rare occasions the given pattern occurs not only in the commit
message but in the GPG signature as well, and after it's replaced in
the signature the resulting signature becomes invalid, GPG will report
CRC error and that it couldn't find any signature, which will then
ultimately cause the test failure.
Since in all three cases the pattern to be replaced during the forgery
is the first word of the commit message's subject line, and since the
GPG signature in the commit object is indented by a space, let's just
anchor those patterns to the beginning of the line to prevent this
issue.
The test script 't7030-verify-tag.sh' creates a forged signed tag
object in a similar way by replacing the pattern "seventh", but the
GPG signature in tag objects is not indented by a space, so the above
solution is not applicable in this case. However, in the tag object
in question the pattern "seventh" occurs not only in the tag message
but in the 'tag' header as well. To create a forged tag object it's
sufficient to replace only one of the two occurences, so modify the
sed script to limit the pattern to the 'tag' header (i.e. a line
beginning with "tag ", which, because of the space character, can
never occur in the base64-encoded GPG signature).
Note that the forgery in 't7004-tag.sh' is not affected by this issue:
while 't7004' does create a forged signed tag kind of the same way,
it replaces "signed-tag" in the tag object, which, because of the '-'
character, can never occur in the base64-encoded GPG signarute.
Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2018-06-04 15:39:26 +02:00
|
|
|
sed -e "s/^seventh/7th forged/" raw >forged1 &&
|
2011-10-20 02:15:05 +02:00
|
|
|
git hash-object -w -t commit forged1 >forged1.commit &&
|
2018-06-04 15:39:25 +02:00
|
|
|
test_must_fail git verify-commit $(cat forged1.commit) &&
|
2011-10-20 02:15:05 +02:00
|
|
|
git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
|
|
|
|
|
grep "BAD signature from" actual1 &&
|
|
|
|
|
! grep "Good signature from" actual1
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'detect fudged signature with NUL' '
|
2014-06-17 01:59:59 +02:00
|
|
|
git cat-file commit seventh-signed >raw &&
|
2011-10-20 02:15:05 +02:00
|
|
|
cat raw >forged2 &&
|
|
|
|
|
echo Qwik | tr "Q" "\000" >>forged2 &&
|
|
|
|
|
git hash-object -w -t commit forged2 >forged2.commit &&
|
2018-06-04 15:39:25 +02:00
|
|
|
test_must_fail git verify-commit $(cat forged2.commit) &&
|
2011-10-20 02:15:05 +02:00
|
|
|
git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
|
|
|
|
|
grep "BAD signature from" actual2 &&
|
|
|
|
|
! grep "Good signature from" actual2
|
|
|
|
|
'
|
|
|
|
|
|
2012-01-05 19:54:14 +01:00
|
|
|
test_expect_success GPG 'amending already signed commit' '
|
|
|
|
|
git checkout fourth-signed^0 &&
|
|
|
|
|
git commit --amend -S --no-edit &&
|
2014-06-23 09:05:51 +02:00
|
|
|
git verify-commit HEAD &&
|
2012-01-05 19:54:14 +01:00
|
|
|
git show -s --show-signature HEAD >actual &&
|
|
|
|
|
grep "Good signature from" actual &&
|
|
|
|
|
! grep "BAD signature from" actual
|
|
|
|
|
'
|
|
|
|
|
|
2014-06-17 02:06:24 +02:00
|
|
|
test_expect_success GPG 'show good signature with custom format' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
G
|
|
|
|
|
13B6F51ECDDE430D
|
|
|
|
|
C O Mitter <committer@example.com>
|
2018-10-22 18:38:20 +02:00
|
|
|
73D758744BE721698EC54E8713B6F51ECDDE430D
|
2018-11-04 10:47:09 +01:00
|
|
|
73D758744BE721698EC54E8713B6F51ECDDE430D
|
2014-06-17 02:06:24 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
|
2014-06-17 02:06:24 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'show bad signature with custom format' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
B
|
|
|
|
|
13B6F51ECDDE430D
|
|
|
|
|
C O Mitter <committer@example.com>
|
2018-10-22 18:38:20 +02:00
|
|
|
|
2018-11-04 10:47:09 +01:00
|
|
|
|
2014-06-17 02:06:24 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat forged1.commit) >actual &&
|
2014-06-17 02:06:24 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
test_expect_success GPG 'show untrusted signature with custom format' '
|
2014-06-17 02:06:24 +02:00
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
U
|
2018-11-04 10:47:10 +01:00
|
|
|
65A0EEA02E30CAD7
|
2014-06-17 02:06:24 +02:00
|
|
|
Eris Discordia <discord@example.net>
|
2018-11-04 10:47:10 +01:00
|
|
|
F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
|
2018-11-04 10:47:09 +01:00
|
|
|
D4BE22311AD3131E5EDA29A461092E85B7227189
|
2014-06-17 02:06:24 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
|
2014-06-17 02:06:24 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
gpg-interface: add minTrustLevel as a configuration option
Previously, signature verification for merge and pull operations checked
if the key had a trust-level of either TRUST_NEVER or TRUST_UNDEFINED in
verify_merge_signature(). If that was the case, the process die()d.
The other code paths that did signature verification relied entirely on
the return code from check_commit_signature(). And signatures made with
a good key, irregardless of its trust level, was considered valid by
check_commit_signature().
This difference in behavior might induce users to erroneously assume
that the trust level of a key in their keyring is always considered by
Git, even for operations where it is not (e.g. during a verify-commit or
verify-tag).
The way it worked was by gpg-interface.c storing the result from the
key/signature status *and* the lowest-two trust levels in the `result`
member of the signature_check structure (the last of these status lines
that were encountered got written to `result`). These are documented in
GPG under the subsection `General status codes` and `Key related`,
respectively [1].
The GPG documentation says the following on the TRUST_ status codes [1]:
"""
These are several similar status codes:
- TRUST_UNDEFINED <error_token>
- TRUST_NEVER <error_token>
- TRUST_MARGINAL [0 [<validation_model>]]
- TRUST_FULLY [0 [<validation_model>]]
- TRUST_ULTIMATE [0 [<validation_model>]]
For good signatures one of these status lines are emitted to
indicate the validity of the key used to create the signature.
The error token values are currently only emitted by gpgsm.
"""
My interpretation is that the trust level is conceptionally different
from the validity of the key and/or signature. That seems to also have
been the assumption of the old code in check_signature() where a result
of 'G' (as in GOODSIG) and 'U' (as in TRUST_NEVER or TRUST_UNDEFINED)
were both considered a success.
The two cases where a result of 'U' had special meaning were in
verify_merge_signature() (where this caused git to die()) and in
format_commit_one() (where it affected the output of the %G? format
specifier).
I think it makes sense to refactor the processing of TRUST_ status lines
such that users can configure a minimum trust level that is enforced
globally, rather than have individual parts of git (e.g. merge) do it
themselves (except for a grace period with backward compatibility).
I also think it makes sense to not store the trust level in the same
struct member as the key/signature status. While the presence of a
TRUST_ status code does imply that the signature is good (see the first
paragraph in the included snippet above), as far as I can tell, the
order of the status lines from GPG isn't well-defined; thus it would
seem plausible that the trust level could be overwritten with the
key/signature status if they were stored in the same member of the
signature_check structure.
This patch introduces a new configuration option: gpg.minTrustLevel. It
consolidates trust-level verification to gpg-interface.c and adds a new
`trust_level` member to the signature_check structure.
Backward-compatibility is maintained by introducing a special case in
verify_merge_signature() such that if no user-configurable
gpg.minTrustLevel is set, then the old behavior of rejecting
TRUST_UNDEFINED and TRUST_NEVER is enforced. If, on the other hand,
gpg.minTrustLevel is set, then that value overrides the old behavior.
Similarly, the %G? format specifier will continue show 'U' for
signatures made with a key that has a trust level of TRUST_UNDEFINED or
TRUST_NEVER, even though the 'U' character no longer exist in the
`result` member of the signature_check structure. A new format
specifier, %GT, is also introduced for users that want to show all
possible trust levels for a signature.
Another approach would have been to simply drop the trust-level
requirement in verify_merge_signature(). This would also have made the
behavior consistent with other parts of git that perform signature
verification. However, requiring a minimum trust level for signing keys
does seem to have a real-world use-case. For example, the build system
used by the Qubes OS project currently parses the raw output from
verify-tag in order to assert a minimum trust level for keys used to
sign git tags [2].
[1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/doc/DETAILS;h=bd00006e933ac56719b1edd2478ecd79273eae72;hb=refs/heads/master
[2] https://github.com/QubesOS/qubes-builder/blob/9674c1991deef45b1a1b1c71fddfab14ba50dccf/scripts/verify-git-tag#L43
Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-12-27 14:55:57 +01:00
|
|
|
test_expect_success GPG 'show untrusted signature with undefined trust level' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
undefined
|
|
|
|
|
65A0EEA02E30CAD7
|
|
|
|
|
Eris Discordia <discord@example.net>
|
|
|
|
|
F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
|
|
|
|
|
D4BE22311AD3131E5EDA29A461092E85B7227189
|
|
|
|
|
EOF
|
|
|
|
|
git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
|
|
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'show untrusted signature with ultimate trust level' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
ultimate
|
|
|
|
|
13B6F51ECDDE430D
|
|
|
|
|
C O Mitter <committer@example.com>
|
|
|
|
|
73D758744BE721698EC54E8713B6F51ECDDE430D
|
|
|
|
|
73D758744BE721698EC54E8713B6F51ECDDE430D
|
|
|
|
|
EOF
|
|
|
|
|
git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
|
|
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
test_expect_success GPG 'show unknown signature with custom format' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
E
|
2018-11-04 10:47:10 +01:00
|
|
|
65A0EEA02E30CAD7
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
|
2018-10-22 18:38:20 +02:00
|
|
|
|
2018-11-04 10:47:09 +01:00
|
|
|
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
|
gpg-interface: use more status letters
According to gpg2's doc/DETAILS:
For each signature only one of the codes GOODSIG, BADSIG,
EXPSIG, EXPKEYSIG, REVKEYSIG or ERRSIG will be emitted.
gpg1 ("classic") behaves the same (although doc/DETAILS differs).
Currently, we parse gpg's status output for GOODSIG, BADSIG and
trust information and translate that into status codes G, B, U, N
for the %G? format specifier.
git-verify-* returns success in the GOODSIG case only. This is
somewhat in disagreement with gpg, which considers the first 5 of
the 6 above as VALIDSIG, but we err on the very safe side.
Introduce additional status codes E, X, Y, R for ERRSIG, EXPSIG,
EXPKEYSIG, and REVKEYSIG so that a user of %G? gets more information
about the absence of a 'G' on first glance.
Requested-by: Alex <agrambot@gmail.com>
Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2016-10-12 15:04:15 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
2014-06-17 02:06:24 +02:00
|
|
|
test_expect_success GPG 'show lack of signature with custom format' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
N
|
|
|
|
|
|
|
|
|
|
|
2018-10-22 18:38:20 +02:00
|
|
|
|
2018-11-04 10:47:09 +01:00
|
|
|
|
2014-06-17 02:06:24 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" seventh-unsigned >actual &&
|
2014-06-17 02:06:24 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
2016-06-22 18:51:26 +02:00
|
|
|
test_expect_success GPG 'log.showsignature behaves like --show-signature' '
|
|
|
|
|
test_config log.showsignature true &&
|
|
|
|
|
git show initial >actual &&
|
|
|
|
|
grep "gpg: Signature made" actual &&
|
|
|
|
|
grep "gpg: Good signature" actual
|
|
|
|
|
'
|
|
|
|
|
|
2018-07-18 11:30:10 +02:00
|
|
|
test_expect_success GPG 'check config gpg.format values' '
|
|
|
|
|
test_config gpg.format openpgp &&
|
|
|
|
|
git commit -S --amend -m "success" &&
|
|
|
|
|
test_config gpg.format OpEnPgP &&
|
|
|
|
|
test_must_fail git commit -S --amend -m "fail"
|
|
|
|
|
'
|
|
|
|
|
|
2018-10-20 21:30:20 +02:00
|
|
|
test_expect_success GPG 'detect fudged commit with double signature' '
|
|
|
|
|
sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
|
|
|
|
|
sed -n -e "/gpgsig/,/END PGP/p" forged1 | \
|
2020-02-22 21:17:42 +01:00
|
|
|
sed -e "s/^$(test_oid header)//;s/^ //" | gpg --dearmor >double-sig1.sig &&
|
2018-10-20 21:30:20 +02:00
|
|
|
gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
|
|
|
|
|
cat double-sig1.sig double-sig2.sig | gpg --enarmor >double-combined.asc &&
|
2020-02-22 21:17:42 +01:00
|
|
|
sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/$(test_oid header) /;2,\$s/^/ /" \
|
2018-10-20 21:30:20 +02:00
|
|
|
double-combined.asc > double-gpgsig &&
|
|
|
|
|
sed -e "/committer/r double-gpgsig" double-base >double-commit &&
|
|
|
|
|
git hash-object -w -t commit double-commit >double-commit.commit &&
|
|
|
|
|
test_must_fail git verify-commit $(cat double-commit.commit) &&
|
|
|
|
|
git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
|
|
|
|
|
grep "BAD signature from" double-actual &&
|
|
|
|
|
grep "Good signature from" double-actual
|
|
|
|
|
'
|
|
|
|
|
|
|
|
|
|
test_expect_success GPG 'show double signature with custom format' '
|
|
|
|
|
cat >expect <<-\EOF &&
|
|
|
|
|
E
|
|
|
|
|
|
|
|
|
|
|
2018-10-22 18:38:20 +02:00
|
|
|
|
2018-11-04 10:47:09 +01:00
|
|
|
|
2018-10-20 21:30:20 +02:00
|
|
|
EOF
|
2018-11-04 10:47:09 +01:00
|
|
|
git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat double-commit.commit) >actual &&
|
2018-10-20 21:30:20 +02:00
|
|
|
test_cmp expect actual
|
|
|
|
|
'
|
|
|
|
|
|
2011-10-20 02:15:05 +02:00
|
|
|
test_done
|