4 #include "run-command.h"
6 #include "gpg-interface.h"
10 static char *configured_signing_key
;
11 static enum signature_trust_level configured_min_trust_level
= TRUST_UNDEFINED
;
16 const char **verify_args
;
18 int (*verify_signed_buffer
)(struct signature_check
*sigc
,
19 struct gpg_format
*fmt
, const char *payload
,
20 size_t payload_size
, const char *signature
,
21 size_t signature_size
);
22 int (*sign_buffer
)(struct strbuf
*buffer
, struct strbuf
*signature
,
23 const char *signing_key
);
26 static const char *openpgp_verify_args
[] = {
27 "--keyid-format=long",
30 static const char *openpgp_sigs
[] = {
31 "-----BEGIN PGP SIGNATURE-----",
32 "-----BEGIN PGP MESSAGE-----",
36 static const char *x509_verify_args
[] = {
39 static const char *x509_sigs
[] = {
40 "-----BEGIN SIGNED MESSAGE-----",
44 static int verify_gpg_signed_buffer(struct signature_check
*sigc
,
45 struct gpg_format
*fmt
, const char *payload
,
46 size_t payload_size
, const char *signature
,
47 size_t signature_size
);
48 static int sign_buffer_gpg(struct strbuf
*buffer
, struct strbuf
*signature
,
49 const char *signing_key
);
51 static struct gpg_format gpg_format
[] = {
55 .verify_args
= openpgp_verify_args
,
57 .verify_signed_buffer
= verify_gpg_signed_buffer
,
58 .sign_buffer
= sign_buffer_gpg
,
63 .verify_args
= x509_verify_args
,
65 .verify_signed_buffer
= verify_gpg_signed_buffer
,
66 .sign_buffer
= sign_buffer_gpg
,
70 static struct gpg_format
*use_format
= &gpg_format
[0];
72 static struct gpg_format
*get_format_by_name(const char *str
)
76 for (i
= 0; i
< ARRAY_SIZE(gpg_format
); i
++)
77 if (!strcmp(gpg_format
[i
].name
, str
))
78 return gpg_format
+ i
;
82 static struct gpg_format
*get_format_by_sig(const char *sig
)
86 for (i
= 0; i
< ARRAY_SIZE(gpg_format
); i
++)
87 for (j
= 0; gpg_format
[i
].sigs
[j
]; j
++)
88 if (starts_with(sig
, gpg_format
[i
].sigs
[j
]))
89 return gpg_format
+ i
;
93 void signature_check_clear(struct signature_check
*sigc
)
95 FREE_AND_NULL(sigc
->payload
);
96 FREE_AND_NULL(sigc
->output
);
97 FREE_AND_NULL(sigc
->gpg_status
);
98 FREE_AND_NULL(sigc
->signer
);
99 FREE_AND_NULL(sigc
->key
);
100 FREE_AND_NULL(sigc
->fingerprint
);
101 FREE_AND_NULL(sigc
->primary_key_fingerprint
);
104 /* An exclusive status -- only one of them can appear in output */
105 #define GPG_STATUS_EXCLUSIVE (1<<0)
106 /* The status includes key identifier */
107 #define GPG_STATUS_KEYID (1<<1)
108 /* The status includes user identifier */
109 #define GPG_STATUS_UID (1<<2)
110 /* The status includes key fingerprints */
111 #define GPG_STATUS_FINGERPRINT (1<<3)
112 /* The status includes trust level */
113 #define GPG_STATUS_TRUST_LEVEL (1<<4)
115 /* Short-hand for standard exclusive *SIG status with keyid & UID */
116 #define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)
122 } sigcheck_gpg_status
[] = {
123 { 'G', "GOODSIG ", GPG_STATUS_STDSIG
},
124 { 'B', "BADSIG ", GPG_STATUS_STDSIG
},
125 { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE
|GPG_STATUS_KEYID
},
126 { 'X', "EXPSIG ", GPG_STATUS_STDSIG
},
127 { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG
},
128 { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG
},
129 { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT
},
130 { 0, "TRUST_", GPG_STATUS_TRUST_LEVEL
},
135 enum signature_trust_level value
;
136 } sigcheck_gpg_trust_level
[] = {
137 { "UNDEFINED", TRUST_UNDEFINED
},
138 { "NEVER", TRUST_NEVER
},
139 { "MARGINAL", TRUST_MARGINAL
},
140 { "FULLY", TRUST_FULLY
},
141 { "ULTIMATE", TRUST_ULTIMATE
},
144 static void replace_cstring(char **field
, const char *line
, const char *next
)
149 *field
= xmemdupz(line
, next
- line
);
154 static int parse_gpg_trust_level(const char *level
,
155 enum signature_trust_level
*res
)
159 for (i
= 0; i
< ARRAY_SIZE(sigcheck_gpg_trust_level
); i
++) {
160 if (!strcmp(sigcheck_gpg_trust_level
[i
].key
, level
)) {
161 *res
= sigcheck_gpg_trust_level
[i
].value
;
168 static void parse_gpg_output(struct signature_check
*sigc
)
170 const char *buf
= sigc
->gpg_status
;
171 const char *line
, *next
;
173 int seen_exclusive_status
= 0;
175 /* Iterate over all lines */
176 for (line
= buf
; *line
; line
= strchrnul(line
+1, '\n')) {
177 while (*line
== '\n')
182 /* Skip lines that don't start with GNUPG status */
183 if (!skip_prefix(line
, "[GNUPG:] ", &line
))
186 /* Iterate over all search strings */
187 for (i
= 0; i
< ARRAY_SIZE(sigcheck_gpg_status
); i
++) {
188 if (skip_prefix(line
, sigcheck_gpg_status
[i
].check
, &line
)) {
190 * GOODSIG, BADSIG etc. can occur only once for
191 * each signature. Therefore, if we had more
192 * than one then we're dealing with multiple
193 * signatures. We don't support them
194 * currently, and they're rather hard to
195 * create, so something is likely fishy and we
196 * should reject them altogether.
198 if (sigcheck_gpg_status
[i
].flags
& GPG_STATUS_EXCLUSIVE
) {
199 if (seen_exclusive_status
++)
203 if (sigcheck_gpg_status
[i
].result
)
204 sigc
->result
= sigcheck_gpg_status
[i
].result
;
205 /* Do we have key information? */
206 if (sigcheck_gpg_status
[i
].flags
& GPG_STATUS_KEYID
) {
207 next
= strchrnul(line
, ' ');
208 replace_cstring(&sigc
->key
, line
, next
);
209 /* Do we have signer information? */
210 if (*next
&& (sigcheck_gpg_status
[i
].flags
& GPG_STATUS_UID
)) {
212 next
= strchrnul(line
, '\n');
213 replace_cstring(&sigc
->signer
, line
, next
);
217 /* Do we have trust level? */
218 if (sigcheck_gpg_status
[i
].flags
& GPG_STATUS_TRUST_LEVEL
) {
220 * GPG v1 and v2 differs in how the
221 * TRUST_ lines are written. Some
222 * trust lines contain no additional
223 * space-separated information for v1.
225 size_t trust_size
= strcspn(line
, " \n");
226 char *trust
= xmemdupz(line
, trust_size
);
228 if (parse_gpg_trust_level(trust
, &sigc
->trust_level
)) {
235 /* Do we have fingerprint? */
236 if (sigcheck_gpg_status
[i
].flags
& GPG_STATUS_FINGERPRINT
) {
240 next
= strchrnul(line
, ' ');
241 replace_cstring(&sigc
->fingerprint
, line
, next
);
244 * Skip interim fields. The search is
245 * limited to the same line since only
246 * OpenPGP signatures has a field with
247 * the primary fingerprint.
249 limit
= strchrnul(line
, '\n');
250 for (j
= 9; j
> 0; j
--) {
251 if (!*next
|| limit
<= next
)
254 next
= strchrnul(line
, ' ');
257 field
= &sigc
->primary_key_fingerprint
;
259 next
= strchrnul(line
, '\n');
260 replace_cstring(field
, line
, next
);
262 replace_cstring(field
, NULL
, NULL
);
274 /* Clear partial data to avoid confusion */
275 FREE_AND_NULL(sigc
->primary_key_fingerprint
);
276 FREE_AND_NULL(sigc
->fingerprint
);
277 FREE_AND_NULL(sigc
->signer
);
278 FREE_AND_NULL(sigc
->key
);
281 static int verify_gpg_signed_buffer(struct signature_check
*sigc
,
282 struct gpg_format
*fmt
, const char *payload
,
283 size_t payload_size
, const char *signature
,
284 size_t signature_size
)
286 struct child_process gpg
= CHILD_PROCESS_INIT
;
287 struct tempfile
*temp
;
289 struct strbuf gpg_stdout
= STRBUF_INIT
;
290 struct strbuf gpg_stderr
= STRBUF_INIT
;
292 temp
= mks_tempfile_t(".git_vtag_tmpXXXXXX");
294 return error_errno(_("could not create temporary file"));
295 if (write_in_full(temp
->fd
, signature
, signature_size
) < 0 ||
296 close_tempfile_gently(temp
) < 0) {
297 error_errno(_("failed writing detached signature to '%s'"),
299 delete_tempfile(&temp
);
303 strvec_push(&gpg
.args
, fmt
->program
);
304 strvec_pushv(&gpg
.args
, fmt
->verify_args
);
305 strvec_pushl(&gpg
.args
,
307 "--verify", temp
->filename
.buf
, "-",
310 sigchain_push(SIGPIPE
, SIG_IGN
);
311 ret
= pipe_command(&gpg
, payload
, payload_size
, &gpg_stdout
, 0,
313 sigchain_pop(SIGPIPE
);
315 delete_tempfile(&temp
);
317 ret
|= !strstr(gpg_stdout
.buf
, "\n[GNUPG:] GOODSIG ");
318 sigc
->payload
= xmemdupz(payload
, payload_size
);
319 sigc
->output
= strbuf_detach(&gpg_stderr
, NULL
);
320 sigc
->gpg_status
= strbuf_detach(&gpg_stdout
, NULL
);
322 parse_gpg_output(sigc
);
324 strbuf_release(&gpg_stdout
);
325 strbuf_release(&gpg_stderr
);
330 int check_signature(const char *payload
, size_t plen
, const char *signature
,
331 size_t slen
, struct signature_check
*sigc
)
333 struct gpg_format
*fmt
;
337 sigc
->trust_level
= -1;
339 fmt
= get_format_by_sig(signature
);
341 die(_("bad/incompatible signature '%s'"), signature
);
343 status
= fmt
->verify_signed_buffer(sigc
, fmt
, payload
, plen
, signature
,
346 if (status
&& !sigc
->output
)
349 status
|= sigc
->result
!= 'G';
350 status
|= sigc
->trust_level
< configured_min_trust_level
;
355 void print_signature_buffer(const struct signature_check
*sigc
, unsigned flags
)
357 const char *output
= flags
& GPG_VERIFY_RAW
? sigc
->gpg_status
:
360 if (flags
& GPG_VERIFY_VERBOSE
&& sigc
->payload
)
361 fputs(sigc
->payload
, stdout
);
364 fputs(output
, stderr
);
367 size_t parse_signed_buffer(const char *buf
, size_t size
)
374 if (get_format_by_sig(buf
+ len
))
377 eol
= memchr(buf
+ len
, '\n', size
- len
);
378 len
+= eol
? eol
- (buf
+ len
) + 1 : size
- len
;
383 int parse_signature(const char *buf
, size_t size
, struct strbuf
*payload
, struct strbuf
*signature
)
385 size_t match
= parse_signed_buffer(buf
, size
);
387 strbuf_add(payload
, buf
, match
);
388 remove_signature(payload
);
389 strbuf_add(signature
, buf
+ match
, size
- match
);
395 void set_signing_key(const char *key
)
397 free(configured_signing_key
);
398 configured_signing_key
= xstrdup(key
);
401 int git_gpg_config(const char *var
, const char *value
, void *cb
)
403 struct gpg_format
*fmt
= NULL
;
404 char *fmtname
= NULL
;
408 if (!strcmp(var
, "user.signingkey")) {
410 return config_error_nonbool(var
);
411 set_signing_key(value
);
415 if (!strcmp(var
, "gpg.format")) {
417 return config_error_nonbool(var
);
418 fmt
= get_format_by_name(value
);
420 return error("unsupported value for %s: %s",
426 if (!strcmp(var
, "gpg.mintrustlevel")) {
428 return config_error_nonbool(var
);
430 trust
= xstrdup_toupper(value
);
431 ret
= parse_gpg_trust_level(trust
, &configured_min_trust_level
);
435 return error("unsupported value for %s: %s", var
,
440 if (!strcmp(var
, "gpg.program") || !strcmp(var
, "gpg.openpgp.program"))
443 if (!strcmp(var
, "gpg.x509.program"))
447 fmt
= get_format_by_name(fmtname
);
448 return git_config_string(&fmt
->program
, var
, value
);
454 const char *get_signing_key(void)
456 if (configured_signing_key
)
457 return configured_signing_key
;
458 return git_committer_info(IDENT_STRICT
|IDENT_NO_DATE
);
461 int sign_buffer(struct strbuf
*buffer
, struct strbuf
*signature
, const char *signing_key
)
463 return use_format
->sign_buffer(buffer
, signature
, signing_key
);
466 static int sign_buffer_gpg(struct strbuf
*buffer
, struct strbuf
*signature
,
467 const char *signing_key
)
469 struct child_process gpg
= CHILD_PROCESS_INIT
;
472 struct strbuf gpg_status
= STRBUF_INIT
;
474 strvec_pushl(&gpg
.args
,
477 "-bsau", signing_key
,
480 bottom
= signature
->len
;
483 * When the username signingkey is bad, program could be terminated
484 * because gpg exits without reading and then write gets SIGPIPE.
486 sigchain_push(SIGPIPE
, SIG_IGN
);
487 ret
= pipe_command(&gpg
, buffer
->buf
, buffer
->len
,
488 signature
, 1024, &gpg_status
, 0);
489 sigchain_pop(SIGPIPE
);
491 ret
|= !strstr(gpg_status
.buf
, "\n[GNUPG:] SIG_CREATED ");
492 strbuf_release(&gpg_status
);
494 return error(_("gpg failed to sign the data"));
496 /* Strip CR from the line endings, in case we are on Windows. */
497 for (i
= j
= bottom
; i
< signature
->len
; i
++)
498 if (signature
->buf
[i
] != '\r') {
500 signature
->buf
[j
] = signature
->buf
[i
];
503 strbuf_setlen(signature
, j
);