Skip to content

Commit 069ff97

Browse files
henning-schildgitster
henning-schild
authored and
gitster
committed
gpg-interface t: extend the existing GPG tests with GPGSM
Add test cases to cover the new X509/gpgsm support. Most of them resemble existing ones. They just switch the format to x509 and set the signingkey when creating signatures. Validation of signatures does not need any configuration of git, it does need gpgsm to be configured to trust the key(-chain). Several of the testcases build on top of existing gpg testcases. The commit ships a self-signed key for [email protected] and configures gpgsm to trust it. Signed-off-by: Henning Schild <[email protected]> Signed-off-by: Junio C Hamano <[email protected]>
1 parent 1142ed2 commit 069ff97

File tree

7 files changed

+172
-1
lines changed

7 files changed

+172
-1
lines changed

‎t/lib-gpg.sh

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,33 @@ then
3838
"$TEST_DIRECTORY"/lib-gpg/ownertrust &&
3939
gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null 2>&1 \
4040
--sign -u [email protected] &&
41-
test_set_prereq GPG
41+
test_set_prereq GPG &&
42+
# Available key info:
43+
# * see t/lib-gpg/gpgsm-gen-key.in
44+
# To generate new certificate:
45+
# * no passphrase
46+
# gpgsm --homedir /tmp/gpghome/ \
47+
# -o /tmp/gpgsm.crt.user \
48+
# --generate-key \
49+
# --batch t/lib-gpg/gpgsm-gen-key.in
50+
# To import certificate:
51+
# gpgsm --homedir /tmp/gpghome/ \
52+
# --import /tmp/gpgsm.crt.user
53+
# To export into a .p12 we can later import:
54+
# gpgsm --homedir /tmp/gpghome/ \
55+
# -o t/lib-gpg/gpgsm_cert.p12 \
56+
# --export-secret-key-p12 "[email protected]"
57+
echo | gpgsm --homedir "${GNUPGHOME}" 2>/dev/null \
58+
--passphrase-fd 0 --pinentry-mode loopback \
59+
--import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
60+
gpgsm --homedir "${GNUPGHOME}" 2>/dev/null -K \
61+
| grep fingerprint: | cut -d" " -f4 | tr -d '\n' > \
62+
${GNUPGHOME}/trustlist.txt &&
63+
echo " S relax" >> ${GNUPGHOME}/trustlist.txt &&
64+
(gpgconf --kill gpg-agent >/dev/null 2>&1 || : ) &&
65+
echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
66+
-u [email protected] -o /dev/null --sign - 2>&1 &&
67+
test_set_prereq GPGSM
4268
;;
4369
esac
4470
fi

‎t/lib-gpg/gpgsm-gen-key.in

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Key-Type: RSA
2+
Key-Length: 2048
3+
Key-Usage: sign
4+
Serial: random
5+
Name-DN: CN=C O Mitter, O=Example, SN=C O, GN=Mitter
6+
Name-Email: [email protected]
7+
Not-Before: 1970-01-01 00:00:00
8+
Not-After: 3000-01-01 00:00:00

‎t/lib-gpg/gpgsm_cert.p12

2.59 KB
Binary file not shown.

‎t/t4202-log.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1556,12 +1556,28 @@ test_expect_success GPG 'setup signed branch' '
15561556
git commit -S -m signed_commit
15571557
'
15581558

1559+
test_expect_success GPGSM 'setup signed branch x509' '
1560+
test_when_finished "git reset --hard && git checkout master" &&
1561+
git checkout -b signed-x509 master &&
1562+
echo foo >foo &&
1563+
git add foo &&
1564+
test_config gpg.format x509 &&
1565+
test_config user.signingkey $GIT_COMMITTER_EMAIL &&
1566+
git commit -S -m signed_commit
1567+
'
1568+
15591569
test_expect_success GPG 'log --graph --show-signature' '
15601570
git log --graph --show-signature -n1 signed >actual &&
15611571
grep "^| gpg: Signature made" actual &&
15621572
grep "^| gpg: Good signature" actual
15631573
'
15641574

1575+
test_expect_success GPGSM 'log --graph --show-signature x509' '
1576+
git log --graph --show-signature -n1 signed-x509 >actual &&
1577+
grep "^| gpgsm: Signature made" actual &&
1578+
grep "^| gpgsm: Good signature" actual
1579+
'
1580+
15651581
test_expect_success GPG 'log --graph --show-signature for merged tag' '
15661582
test_when_finished "git reset --hard && git checkout master" &&
15671583
git checkout -b plain master &&
@@ -1581,6 +1597,29 @@ test_expect_success GPG 'log --graph --show-signature for merged tag' '
15811597
grep "^| | gpg: Good signature" actual
15821598
'
15831599

1600+
test_expect_success GPGSM 'log --graph --show-signature for merged tag x509' '
1601+
test_when_finished "git reset --hard && git checkout master" &&
1602+
test_config gpg.format x509 &&
1603+
test_config user.signingkey $GIT_COMMITTER_EMAIL &&
1604+
git checkout -b plain-x509 master &&
1605+
echo aaa >bar &&
1606+
git add bar &&
1607+
git commit -m bar_commit &&
1608+
git checkout -b tagged-x509 master &&
1609+
echo bbb >baz &&
1610+
git add baz &&
1611+
git commit -m baz_commit &&
1612+
git tag -s -m signed_tag_msg signed_tag_x509 &&
1613+
git checkout plain-x509 &&
1614+
git merge --no-ff -m msg signed_tag_x509 &&
1615+
git log --graph --show-signature -n1 plain-x509 >actual &&
1616+
grep "^|\\\ merged tag" actual &&
1617+
grep "^| | gpgsm: Signature made" actual &&
1618+
grep "^| | gpgsm: Good signature" actual &&
1619+
git config --unset gpg.format &&
1620+
git config --unset user.signingkey
1621+
'
1622+
15841623
test_expect_success GPG '--no-show-signature overrides --show-signature' '
15851624
git log -1 --show-signature --no-show-signature signed >actual &&
15861625
! grep "^gpg:" actual

‎t/t5534-push-signed.sh

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,4 +218,56 @@ test_expect_success GPG 'fail without key and heed user.signingkey' '
218218
test_cmp expect dst/push-cert-status
219219
'
220220

221+
test_expect_success GPGSM 'fail without key and heed user.signingkey x509' '
222+
test_config gpg.format x509 &&
223+
env | grep GIT > envfile &&
224+
prepare_dst &&
225+
mkdir -p dst/.git/hooks &&
226+
git -C dst config receive.certnonceseed sekrit &&
227+
write_script dst/.git/hooks/post-receive <<-\EOF &&
228+
# discard the update list
229+
cat >/dev/null
230+
# record the push certificate
231+
if test -n "${GIT_PUSH_CERT-}"
232+
then
233+
git cat-file blob $GIT_PUSH_CERT >../push-cert
234+
fi &&
235+
236+
cat >../push-cert-status <<E_O_F
237+
SIGNER=${GIT_PUSH_CERT_SIGNER-nobody}
238+
KEY=${GIT_PUSH_CERT_KEY-nokey}
239+
STATUS=${GIT_PUSH_CERT_STATUS-nostatus}
240+
NONCE_STATUS=${GIT_PUSH_CERT_NONCE_STATUS-nononcestatus}
241+
NONCE=${GIT_PUSH_CERT_NONCE-nononce}
242+
E_O_F
243+
244+
EOF
245+
unset GIT_COMMITTER_EMAIL &&
246+
git config user.email [email protected] &&
247+
git config user.signingkey "" &&
248+
test_must_fail git push --signed dst noop ff +noff &&
249+
git config user.signingkey [email protected] &&
250+
git push --signed dst noop ff +noff &&
251+
252+
(
253+
cat <<-\EOF &&
254+
SIGNER=/CN=C O Mitter/O=Example/SN=C O/GN=Mitter
255+
KEY=
256+
STATUS=G
257+
NONCE_STATUS=OK
258+
EOF
259+
sed -n -e "s/^nonce /NONCE=/p" -e "/^$/q" dst/push-cert
260+
) >expect.in &&
261+
key=$(cat "${GNUPGHOME}/trustlist.txt" | cut -d" " -f1 | tr -d ":") &&
262+
sed -e "s/^KEY=/KEY=${key}/" expect.in > expect &&
263+
264+
noop=$(git rev-parse noop) &&
265+
ff=$(git rev-parse ff) &&
266+
noff=$(git rev-parse noff) &&
267+
grep "$noop $ff refs/heads/ff" dst/push-cert &&
268+
grep "$noop $noff refs/heads/noff" dst/push-cert &&
269+
test_cmp expect dst/push-cert-status
270+
'
271+
272+
221273
test_done

‎t/t7004-tag.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1354,6 +1354,19 @@ test_expect_success GPG \
13541354
'test_config gpg.program echo &&
13551355
test_must_fail git tag -s -m tail tag-gpg-failure'
13561356

1357+
# try to sign with bad user.signingkey
1358+
test_expect_success GPGSM \
1359+
'git tag -s fails if gpgsm is misconfigured (bad key)' \
1360+
'test_config user.signingkey BobTheMouse &&
1361+
test_config gpg.format x509 &&
1362+
test_must_fail git tag -s -m tail tag-gpg-failure'
1363+
1364+
# try to produce invalid signature
1365+
test_expect_success GPGSM \
1366+
'git tag -s fails if gpgsm is misconfigured (bad signature format)' \
1367+
'test_config gpg.x509.program echo &&
1368+
test_config gpg.format x509 &&
1369+
test_must_fail git tag -s -m tail tag-gpg-failure'
13571370

13581371
# try to verify without gpg:
13591372

‎t/t7030-verify-tag.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,13 @@ test_expect_success GPG 'create signed tags' '
4141
git tag -uB7227189 -m eighth eighth-signed-alt
4242
'
4343

44+
test_expect_success GPGSM 'create signed tags x509 ' '
45+
test_config gpg.format x509 &&
46+
test_config user.signingkey $GIT_COMMITTER_EMAIL &&
47+
echo 9 >file && test_tick && git commit -a -m "nineth gpgsm-signed" &&
48+
git tag -s -m nineth nineth-signed-x509
49+
'
50+
4451
test_expect_success GPG 'verify and show signatures' '
4552
(
4653
for tag in initial second merge fourth-signed sixth-signed seventh-signed
@@ -72,6 +79,13 @@ test_expect_success GPG 'verify and show signatures' '
7279
)
7380
'
7481

82+
test_expect_success GPGSM 'verify and show signatures x509' '
83+
git verify-tag nineth-signed-x509 2>actual &&
84+
grep "Good signature from" actual &&
85+
! grep "BAD signature from" actual &&
86+
echo nineth-signed-x509 OK
87+
'
88+
7589
test_expect_success GPG 'detect fudged signature' '
7690
git cat-file tag seventh-signed >raw &&
7791
sed -e "/^tag / s/seventh/7th forged/" raw >forged1 &&
@@ -112,6 +126,12 @@ test_expect_success GPG 'verify signatures with --raw' '
112126
)
113127
'
114128

129+
test_expect_success GPGSM 'verify signatures with --raw x509' '
130+
git verify-tag --raw nineth-signed-x509 2>actual &&
131+
grep "GOODSIG" actual &&
132+
! grep "BADSIG" actual &&
133+
echo nineth-signed-x509 OK
134+
'
115135
test_expect_success GPG 'verify multiple tags' '
116136
tags="fourth-signed sixth-signed seventh-signed" &&
117137
for i in $tags
@@ -125,6 +145,19 @@ test_expect_success GPG 'verify multiple tags' '
125145
test_cmp expect.stderr actual.stderr
126146
'
127147

148+
test_expect_success GPGSM 'verify multiple tags x509' '
149+
tags="seventh-signed nineth-signed-x509" &&
150+
for i in $tags
151+
do
152+
git verify-tag -v --raw $i || return 1
153+
done >expect.stdout 2>expect.stderr.1 &&
154+
grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
155+
git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
156+
grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
157+
test_cmp expect.stdout actual.stdout &&
158+
test_cmp expect.stderr actual.stderr
159+
'
160+
128161
test_expect_success GPG 'verifying tag with --format' '
129162
cat >expect <<-\EOF &&
130163
tagname : fourth-signed

0 commit comments

Comments
 (0)