[thirdparty/git.git] / t / t7510-signed-commit.sh

#!/bin/sh

test_description='signed commit tests'
. ./test-lib.sh
GNUPGHOME_NOT_USED=$GNUPGHOME
. "$TEST_DIRECTORY/lib-gpg.sh"

test_expect_success GPG 'create signed commits' '
	test_when_finished "test_unconfig commit.gpgsign" &&

	echo 1 >file && git add file &&
	test_tick && git commit -S -m initial &&
	git tag initial &&
	git branch side &&

	echo 2 >file && test_tick && git commit -a -S -m second &&
	git tag second &&

	git checkout side &&
	echo 3 >elif && git add elif &&
	test_tick && git commit -m "third on side" &&

	git checkout master &&
	test_tick && git merge -S side &&
	git tag merge &&

	echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
	git tag fourth-unsigned &&

	test_tick && git commit --amend -S -m "fourth signed" &&
	git tag fourth-signed &&

	git config commit.gpgsign true &&
	echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
	git tag fifth-signed &&

	git config commit.gpgsign false &&
	echo 6 >file && test_tick && git commit -a -m "sixth" &&
	git tag sixth-unsigned &&

	git config commit.gpgsign true &&
	echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
	git tag seventh-unsigned &&

	test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
	git tag seventh-signed &&

	echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
	git tag eighth-signed-alt &&

	# commit.gpgsign is still on but this must not be signed
	git tag ninth-unsigned $(echo 9 | git commit-tree HEAD^{tree}) &&
	# explicit -S of course must sign.
	git tag tenth-signed $(echo 9 | git commit-tree -S HEAD^{tree})
'

test_expect_success GPG 'verify and show signatures' '
	(
		for commit in initial second merge fourth-signed \
			fifth-signed sixth-signed seventh-signed tenth-signed
		do
			git verify-commit $commit &&
			git show --pretty=short --show-signature $commit >actual &&
			grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in merge^2 fourth-unsigned sixth-unsigned \
			seventh-unsigned ninth-unsigned
		do
			test_must_fail git verify-commit $commit &&
			git show --pretty=short --show-signature $commit >actual &&
			! grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in eighth-signed-alt
		do
			git show --pretty=short --show-signature $commit >actual &&
			grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			grep "not certified" actual &&
			echo $commit OK || exit 1
		done
	)
'

test_expect_success GPG 'verify-commit exits success on untrusted signature' '
	git verify-commit eighth-signed-alt 2>actual &&
	grep "Good signature from" actual &&
	! grep "BAD signature from" actual &&
	grep "not certified" actual
'

test_expect_success GPG 'verify signatures with --raw' '
	(
		for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
		do
			git verify-commit --raw $commit 2>actual &&
			grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
		do
			test_must_fail git verify-commit --raw $commit 2>actual &&
			! grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in eighth-signed-alt
		do
			git verify-commit --raw $commit 2>actual &&
			grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			grep "TRUST_UNDEFINED" actual &&
			echo $commit OK || exit 1
		done
	)
'

test_expect_success GPG 'show signed commit with signature' '
	git show -s initial >commit &&
	git show -s --show-signature initial >show &&
	git verify-commit -v initial >verify.1 2>verify.2 &&
	git cat-file commit initial >cat &&
	grep -v -e "gpg: " -e "Warning: " show >show.commit &&
	grep -e "gpg: " -e "Warning: " show >show.gpg &&
	grep -v "^ " cat | grep -v "^gpgsig " >cat.commit &&
	test_cmp show.commit commit &&
	test_cmp show.gpg verify.2 &&
	test_cmp cat.commit verify.1
'

test_expect_success GPG 'detect fudged signature' '
	git cat-file commit seventh-signed >raw &&
	sed -e "s/^seventh/7th forged/" raw >forged1 &&
	git hash-object -w -t commit forged1 >forged1.commit &&
	test_must_fail git verify-commit $(cat forged1.commit) &&
	git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
	grep "BAD signature from" actual1 &&
	! grep "Good signature from" actual1
'

test_expect_success GPG 'detect fudged signature with NUL' '
	git cat-file commit seventh-signed >raw &&
	cat raw >forged2 &&
	echo Qwik | tr "Q" "\000" >>forged2 &&
	git hash-object -w -t commit forged2 >forged2.commit &&
	test_must_fail git verify-commit $(cat forged2.commit) &&
	git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
	grep "BAD signature from" actual2 &&
	! grep "Good signature from" actual2
'

test_expect_success GPG 'amending already signed commit' '
	git checkout fourth-signed^0 &&
	git commit --amend -S --no-edit &&
	git verify-commit HEAD &&
	git show -s --show-signature HEAD >actual &&
	grep "Good signature from" actual &&
	! grep "BAD signature from" actual
'

test_expect_success GPG 'show good signature with custom format' '
	cat >expect <<-\EOF &&
	G
	13B6F51ECDDE430D
	C O Mitter <committer@example.com>
	73D758744BE721698EC54E8713B6F51ECDDE430D
	73D758744BE721698EC54E8713B6F51ECDDE430D
	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show bad signature with custom format' '
	cat >expect <<-\EOF &&
	B
	13B6F51ECDDE430D
	C O Mitter <committer@example.com>


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat forged1.commit) >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show untrusted signature with custom format' '
	cat >expect <<-\EOF &&
	U
	65A0EEA02E30CAD7
	Eris Discordia <discord@example.net>
	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
	D4BE22311AD3131E5EDA29A461092E85B7227189
	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show unknown signature with custom format' '
	cat >expect <<-\EOF &&
	E
	65A0EEA02E30CAD7


	EOF
	GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show lack of signature with custom format' '
	cat >expect <<-\EOF &&
	N


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" seventh-unsigned >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'log.showsignature behaves like --show-signature' '
	test_config log.showsignature true &&
	git show initial >actual &&
	grep "gpg: Signature made" actual &&
	grep "gpg: Good signature" actual
'

test_expect_success GPG 'check config gpg.format values' '
	test_config gpg.format openpgp &&
	git commit -S --amend -m "success" &&
	test_config gpg.format OpEnPgP &&
	test_must_fail git commit -S --amend -m "fail"
'

test_expect_success GPG 'detect fudged commit with double signature' '
	sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
	sed -n -e "/gpgsig/,/END PGP/p" forged1 | \
		sed -e "s/^gpgsig//;s/^ //" | gpg --dearmor >double-sig1.sig &&
	gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
	cat double-sig1.sig double-sig2.sig | gpg --enarmor >double-combined.asc &&
	sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/gpgsig /;2,\$s/^/ /" \
		double-combined.asc > double-gpgsig &&
	sed -e "/committer/r double-gpgsig" double-base >double-commit &&
	git hash-object -w -t commit double-commit >double-commit.commit &&
	test_must_fail git verify-commit $(cat double-commit.commit) &&
	git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
	grep "BAD signature from" double-actual &&
	grep "Good signature from" double-actual
'

test_expect_success GPG 'show double signature with custom format' '
	cat >expect <<-\EOF &&
	E


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat double-commit.commit) >actual &&
	test_cmp expect actual
'

test_done
Commit	Line	Data
247503f2 JH	1	#!/bin/sh
	2
	3	test_description='signed commit tests'
	4	. ./test-lib.sh
661a1806	5	GNUPGHOME_NOT_USED=$GNUPGHOME
247503f2 JH	6	. "$TEST_DIRECTORY/lib-gpg.sh"
	7
	8	test_expect_success GPG 'create signed commits' '
4b8d14b4 NV	9	test_when_finished "test_unconfig commit.gpgsign" &&
4b8d14b4 NV	10
247503f2 JH	11	echo 1 >file && git add file &&
	12	test_tick && git commit -S -m initial &&
	13	git tag initial &&
	14	git branch side &&
	15
	16	echo 2 >file && test_tick && git commit -a -S -m second &&
	17	git tag second &&
	18
	19	git checkout side &&
	20	echo 3 >elif && git add elif &&
	21	test_tick && git commit -m "third on side" &&
	22
	23	git checkout master &&
	24	test_tick && git merge -S side &&
	25	git tag merge &&
	26
	27	echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
	28	git tag fourth-unsigned &&
	29
c871a1d1	30	test_tick && git commit --amend -S -m "fourth signed" &&
4b8d14b4 NV	31	git tag fourth-signed &&
	32
	33	git config commit.gpgsign true &&
	34	echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
	35	git tag fifth-signed &&
	36
	37	git config commit.gpgsign false &&
	38	echo 6 >file && test_tick && git commit -a -m "sixth" &&
	39	git tag sixth-unsigned &&
	40
	41	git config commit.gpgsign true &&
	42	echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
	43	git tag seventh-unsigned &&
	44
	45	test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
99094a7a	46	git tag seventh-signed &&
4baf839f JK	47
4baf839f JK	48	echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
66948561 JH	49	git tag eighth-signed-alt &&
	50
	51	# commit.gpgsign is still on but this must not be signed
	52	git tag ninth-unsigned $(echo 9 \| git commit-tree HEAD^{tree}) &&
	53	# explicit -S of course must sign.
	54	git tag tenth-signed $(echo 9 \| git commit-tree -S HEAD^{tree})
247503f2 JH	55	'
247503f2 JH	56
8e92c2cf	57	test_expect_success GPG 'verify and show signatures' '
247503f2	58	(
66948561 JH	59	for commit in initial second merge fourth-signed \
66948561 JH	60	fifth-signed sixth-signed seventh-signed tenth-signed
247503f2	61	do
8e92c2cf	62	git verify-commit $commit &&
247503f2	63	git show --pretty=short --show-signature $commit >actual &&
7b1732c1 MG	64	grep "Good signature from" actual &&
	65	! grep "BAD signature from" actual &&
	66	echo $commit OK \|\| exit 1
247503f2 JH	67	done
	68	) &&
	69	(
66948561 JH	70	for commit in merge^2 fourth-unsigned sixth-unsigned \
66948561 JH	71	seventh-unsigned ninth-unsigned
247503f2	72	do
8e92c2cf	73	test_must_fail git verify-commit $commit &&
247503f2	74	git show --pretty=short --show-signature $commit >actual &&
7b1732c1 MG	75	! grep "Good signature from" actual &&
	76	! grep "BAD signature from" actual &&
	77	echo $commit OK \|\| exit 1
4baf839f JK	78	done
	79	) &&
	80	(
	81	for commit in eighth-signed-alt
	82	do
	83	git show --pretty=short --show-signature $commit >actual &&
	84	grep "Good signature from" actual &&
	85	! grep "BAD signature from" actual &&
	86	grep "not certified" actual &&
	87	echo $commit OK \|\| exit 1
247503f2 JH	88	done
	89	)
	90	'
	91
434060ec	92	test_expect_success GPG 'verify-commit exits success on untrusted signature' '
8e98e5f2	93	git verify-commit eighth-signed-alt 2>actual &&
	94	grep "Good signature from" actual &&
	95	! grep "BAD signature from" actual &&
	96	grep "not certified" actual
	97	'
	98
aeff29dd	99	test_expect_success GPG 'verify signatures with --raw' '
	100	(
	101	for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
	102	do
	103	git verify-commit --raw $commit 2>actual &&
	104	grep "GOODSIG" actual &&
	105	! grep "BADSIG" actual &&
	106	echo $commit OK \|\| exit 1
	107	done
	108	) &&
	109	(
	110	for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
	111	do
	112	test_must_fail git verify-commit --raw $commit 2>actual &&
	113	! grep "GOODSIG" actual &&
	114	! grep "BADSIG" actual &&
	115	echo $commit OK \|\| exit 1
	116	done
	117	) &&
	118	(
	119	for commit in eighth-signed-alt
	120	do
	121	git verify-commit --raw $commit 2>actual &&
	122	grep "GOODSIG" actual &&
	123	! grep "BADSIG" actual &&
	124	grep "TRUST_UNDEFINED" actual &&
	125	echo $commit OK \|\| exit 1
	126	done
	127	)
	128	'
	129
8e92c2cf MG	130	test_expect_success GPG 'show signed commit with signature' '
	131	git show -s initial >commit &&
	132	git show -s --show-signature initial >show &&
	133	git verify-commit -v initial >verify.1 2>verify.2 &&
	134	git cat-file commit initial >cat &&
3f88c1b5 KM	135	grep -v -e "gpg: " -e "Warning: " show >show.commit &&
3f88c1b5 KM	136	grep -e "gpg: " -e "Warning: " show >show.gpg &&
8e92c2cf MG	137	grep -v "^ " cat \| grep -v "^gpgsig " >cat.commit &&
	138	test_cmp show.commit commit &&
	139	test_cmp show.gpg verify.2 &&
	140	test_cmp cat.commit verify.1
	141	'
	142
247503f2	143	test_expect_success GPG 'detect fudged signature' '
526d56e0	144	git cat-file commit seventh-signed >raw &&
2f3cbcd8	145	sed -e "s/^seventh/7th forged/" raw >forged1 &&
247503f2	146	git hash-object -w -t commit forged1 >forged1.commit &&
9dd39821	147	test_must_fail git verify-commit $(cat forged1.commit) &&
247503f2 JH	148	git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
	149	grep "BAD signature from" actual1 &&
	150	! grep "Good signature from" actual1
	151	'
	152
	153	test_expect_success GPG 'detect fudged signature with NUL' '
526d56e0	154	git cat-file commit seventh-signed >raw &&
247503f2 JH	155	cat raw >forged2 &&
	156	echo Qwik \| tr "Q" "\000" >>forged2 &&
	157	git hash-object -w -t commit forged2 >forged2.commit &&
9dd39821	158	test_must_fail git verify-commit $(cat forged2.commit) &&
247503f2 JH	159	git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
	160	grep "BAD signature from" actual2 &&
	161	! grep "Good signature from" actual2
	162	'
	163
c871a1d1 JH	164	test_expect_success GPG 'amending already signed commit' '
	165	git checkout fourth-signed^0 &&
	166	git commit --amend -S --no-edit &&
8e92c2cf	167	git verify-commit HEAD &&
c871a1d1 JH	168	git show -s --show-signature HEAD >actual &&
	169	grep "Good signature from" actual &&
	170	! grep "BAD signature from" actual
	171	'
	172
06ca0f45 JK	173	test_expect_success GPG 'show good signature with custom format' '
	174	cat >expect <<-\EOF &&
	175	G
	176	13B6F51ECDDE430D
	177	C O Mitter <committer@example.com>
3daaaabe	178	73D758744BE721698EC54E8713B6F51ECDDE430D
1a550529	179	73D758744BE721698EC54E8713B6F51ECDDE430D
06ca0f45	180	EOF
1a550529	181	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
06ca0f45 JK	182	test_cmp expect actual
	183	'
	184
	185	test_expect_success GPG 'show bad signature with custom format' '
	186	cat >expect <<-\EOF &&
	187	B
	188	13B6F51ECDDE430D
	189	C O Mitter <committer@example.com>
3daaaabe	190
1a550529	191
06ca0f45	192	EOF
1a550529	193	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat forged1.commit) >actual &&
06ca0f45 JK	194	test_cmp expect actual
	195	'
	196
661a1806	197	test_expect_success GPG 'show untrusted signature with custom format' '
06ca0f45 JK	198	cat >expect <<-\EOF &&
06ca0f45 JK	199	U
1e690847	200	65A0EEA02E30CAD7
06ca0f45	201	Eris Discordia <discord@example.net>
1e690847	202	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
1a550529	203	D4BE22311AD3131E5EDA29A461092E85B7227189
06ca0f45	204	EOF
1a550529	205	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
06ca0f45 JK	206	test_cmp expect actual
	207	'
	208
661a1806 MG	209	test_expect_success GPG 'show unknown signature with custom format' '
	210	cat >expect <<-\EOF &&
	211	E
1e690847	212	65A0EEA02E30CAD7
661a1806	213
3daaaabe	214
1a550529	215
661a1806	216	EOF
1a550529	217	GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
661a1806 MG	218	test_cmp expect actual
	219	'
	220
06ca0f45 JK	221	test_expect_success GPG 'show lack of signature with custom format' '
	222	cat >expect <<-\EOF &&
	223	N
	224
	225
3daaaabe	226
1a550529	227
06ca0f45	228	EOF
1a550529	229	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" seventh-unsigned >actual &&
06ca0f45 JK	230	test_cmp expect actual
	231	'
	232
fce04c3c MJ	233	test_expect_success GPG 'log.showsignature behaves like --show-signature' '
	234	test_config log.showsignature true &&
	235	git show initial >actual &&
	236	grep "gpg: Signature made" actual &&
	237	grep "gpg: Good signature" actual
	238	'
	239
1865a647 HS	240	test_expect_success GPG 'check config gpg.format values' '
	241	test_config gpg.format openpgp &&
	242	git commit -S --amend -m "success" &&
	243	test_config gpg.format OpEnPgP &&
	244	test_must_fail git commit -S --amend -m "fail"
	245	'
	246
da6cf1b3 MG	247	test_expect_success GPG 'detect fudged commit with double signature' '
	248	sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
	249	sed -n -e "/gpgsig/,/END PGP/p" forged1 \| \
	250	sed -e "s/^gpgsig//;s/^ //" \| gpg --dearmor >double-sig1.sig &&
	251	gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
	252	cat double-sig1.sig double-sig2.sig \| gpg --enarmor >double-combined.asc &&
	253	sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/gpgsig /;2,\$s/^/ /" \
	254	double-combined.asc > double-gpgsig &&
	255	sed -e "/committer/r double-gpgsig" double-base >double-commit &&
	256	git hash-object -w -t commit double-commit >double-commit.commit &&
	257	test_must_fail git verify-commit $(cat double-commit.commit) &&
	258	git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
	259	grep "BAD signature from" double-actual &&
	260	grep "Good signature from" double-actual
	261	'
	262
	263	test_expect_success GPG 'show double signature with custom format' '
	264	cat >expect <<-\EOF &&
	265	E
	266
	267
3daaaabe	268
1a550529	269
da6cf1b3	270	EOF
1a550529	271	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat double-commit.commit) >actual &&
da6cf1b3 MG	272	test_cmp expect actual
	273	'
	274
247503f2	275	test_done