fd2d4c135e
Instead of forcing the porcelain commands to always read the configuration variables related to the signing and verifying signatures, lazily initialize the necessary subsystem on demand upon the first use. This hopefully would make it more future-proof as we do not have to think and decide whether we should call git_gpg_config() in the git_config() callback for each command. A few git_config() callback functions that used to be custom callbacks are now just a thin wrapper around git_default_config(). We could further remove, git_FOO_config and replace calls to git_config(git_FOO_config) with git_config(git_default_config), but to make it clear which ones are affected and the effect is only the removal of git_gpg_config(), it is vastly preferred not to do such a change in this step (they can be done on top once the dust settled). Signed-off-by: Junio C Hamano <gitster@pobox.com>
214 lines
7.5 KiB
Bash
Executable File
214 lines
7.5 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
test_description='signed tag tests'
|
|
GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
|
|
export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
|
|
|
|
. ./test-lib.sh
|
|
. "$TEST_DIRECTORY/lib-gpg.sh"
|
|
|
|
test_expect_success GPGSSH 'create signed tags ssh' '
|
|
test_when_finished "test_unconfig commit.gpgsign" &&
|
|
test_config gpg.format ssh &&
|
|
test_config user.signingkey "${GPGSSH_KEY_PRIMARY}" &&
|
|
|
|
echo 1 >file && git add file &&
|
|
test_tick && git commit -m initial &&
|
|
git tag -s -m initial initial &&
|
|
git branch side &&
|
|
|
|
echo 2 >file && test_tick && git commit -a -m second &&
|
|
git tag -s -m second second &&
|
|
|
|
git checkout side &&
|
|
echo 3 >elif && git add elif &&
|
|
test_tick && git commit -m "third on side" &&
|
|
|
|
git checkout main &&
|
|
test_tick && git merge -S side &&
|
|
git tag -s -m merge merge &&
|
|
|
|
echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" &&
|
|
git tag -a -m fourth-unsigned fourth-unsigned &&
|
|
|
|
test_tick && git commit --amend -S -m "fourth signed" &&
|
|
git tag -s -m fourth fourth-signed &&
|
|
|
|
echo 5 >file && test_tick && git commit -a -m "fifth" &&
|
|
git tag fifth-unsigned &&
|
|
|
|
git config commit.gpgsign true &&
|
|
echo 6 >file && test_tick && git commit -a -m "sixth" &&
|
|
git tag -a -m sixth sixth-unsigned &&
|
|
|
|
test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ &&
|
|
git tag -m seventh -s seventh-signed &&
|
|
|
|
echo 8 >file && test_tick && git commit -a -m eighth &&
|
|
git tag -u"${GPGSSH_KEY_UNTRUSTED}" -m eighth eighth-signed-alt
|
|
'
|
|
|
|
test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'create signed tags with keys having defined lifetimes' '
|
|
test_when_finished "test_unconfig commit.gpgsign" &&
|
|
test_config gpg.format ssh &&
|
|
|
|
echo expired >file && test_tick && git commit -a -m expired -S"${GPGSSH_KEY_EXPIRED}" &&
|
|
git tag -s -u "${GPGSSH_KEY_EXPIRED}" -m expired-signed expired-signed &&
|
|
|
|
echo notyetvalid >file && test_tick && git commit -a -m notyetvalid -S"${GPGSSH_KEY_NOTYETVALID}" &&
|
|
git tag -s -u "${GPGSSH_KEY_NOTYETVALID}" -m notyetvalid-signed notyetvalid-signed &&
|
|
|
|
echo timeboxedvalid >file && test_tick && git commit -a -m timeboxedvalid -S"${GPGSSH_KEY_TIMEBOXEDVALID}" &&
|
|
git tag -s -u "${GPGSSH_KEY_TIMEBOXEDVALID}" -m timeboxedvalid-signed timeboxedvalid-signed &&
|
|
|
|
echo timeboxedinvalid >file && test_tick && git commit -a -m timeboxedinvalid -S"${GPGSSH_KEY_TIMEBOXEDINVALID}" &&
|
|
git tag -s -u "${GPGSSH_KEY_TIMEBOXEDINVALID}" -m timeboxedinvalid-signed timeboxedinvalid-signed
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verify and show ssh signatures' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
(
|
|
for tag in initial second merge fourth-signed sixth-signed seventh-signed
|
|
do
|
|
git verify-tag $tag 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
|
|
do
|
|
test_must_fail git verify-tag $tag 2>actual &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in eighth-signed-alt
|
|
do
|
|
test_must_fail git verify-tag $tag 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
grep "${GPGSSH_KEY_NOT_TRUSTED}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
)
|
|
'
|
|
|
|
test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-tag exits failure on expired signature key' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
test_must_fail git verify-tag expired-signed 2>actual &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
|
|
'
|
|
|
|
test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-tag exits failure on not yet valid signature key' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
test_must_fail git verify-tag notyetvalid-signed 2>actual &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
|
|
'
|
|
|
|
test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-tag succeeds with tag date and key validity matching' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
git verify-tag timeboxedvalid-signed 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual
|
|
'
|
|
|
|
test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-tag failes with tag date outside of key validity' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
test_must_fail git verify-tag timeboxedinvalid-signed 2>actual &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
|
|
'
|
|
|
|
test_expect_success GPGSSH 'detect fudged ssh signature' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
git cat-file tag seventh-signed >raw &&
|
|
sed -e "/^tag / s/seventh/7th-forged/" raw >forged1 &&
|
|
git hash-object -w -t tag forged1 >forged1.tag &&
|
|
test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&
|
|
grep "${GPGSSH_BAD_SIGNATURE}" actual1 &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual1 &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual1
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verify ssh signatures with --raw' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
(
|
|
for tag in initial second merge fourth-signed sixth-signed seventh-signed
|
|
do
|
|
git verify-tag --raw $tag 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
|
|
do
|
|
test_must_fail git verify-tag --raw $tag 2>actual &&
|
|
! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in eighth-signed-alt
|
|
do
|
|
test_must_fail git verify-tag --raw $tag 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
)
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verify signatures with --raw ssh' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
git verify-tag --raw sixth-signed 2>actual &&
|
|
grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
|
|
! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
|
|
echo sixth-signed OK
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verify multiple tags ssh' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
tags="seventh-signed sixth-signed" &&
|
|
for i in $tags
|
|
do
|
|
git verify-tag -v --raw $i || return 1
|
|
done >expect.stdout 2>expect.stderr.1 &&
|
|
grep "^${GPGSSH_GOOD_SIGNATURE_TRUSTED}" <expect.stderr.1 >expect.stderr &&
|
|
git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
|
|
grep "^${GPGSSH_GOOD_SIGNATURE_TRUSTED}" <actual.stderr.1 >actual.stderr &&
|
|
test_cmp expect.stdout actual.stdout &&
|
|
test_cmp expect.stderr actual.stderr
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verifying tag with --format - ssh' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
cat >expect <<-\EOF &&
|
|
tagname : fourth-signed
|
|
EOF
|
|
git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success GPGSSH 'verifying a forged tag with --format should fail silently - ssh' '
|
|
test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged &&
|
|
test_must_be_empty actual-forged
|
|
'
|
|
|
|
test_expect_success GPGSSH 'rev-list --format=%G' '
|
|
test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
|
|
git rev-list -1 --format="%G? %H" sixth-signed >actual &&
|
|
cat >expect <<-EOF &&
|
|
commit $(git rev-parse sixth-signed^0)
|
|
G $(git rev-parse sixth-signed^0)
|
|
EOF
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_done
|