Merge branch 'tl/doc-cli-options-first'

[thirdparty/git.git] / t / t7528-signed-commit-ssh.sh

diff --git a/t/t7528-signed-commit-ssh.sh b/t/t7528-signed-commit-ssh.sh
index badf3ed320406ea5550e7b24b82216d147a48e80..f47e99517983163e0bbb3fce9c35800270fe4e28 100755 (executable)
--- a/t/t7528-signed-commit-ssh.sh
+++ b/t/t7528-signed-commit-ssh.sh
@@ -73,7 +73,46 @@ test_expect_success GPGSSH 'create signed commits' '
        git tag eleventh-signed $(cat oid) &&
        echo 12 | git commit-tree --gpg-sign="${GPGSSH_KEY_UNTRUSTED}" HEAD^{tree} >oid &&
        test_line_count = 1 oid &&
-       git tag twelfth-signed-alt $(cat oid)
+       git tag twelfth-signed-alt $(cat oid) &&
+
+       echo 13>file && test_tick && git commit -a -m thirteenth -S"${GPGSSH_KEY_ECDSA}" &&
+       git tag thirteenth-signed-ecdsa
+'
+
+test_expect_success GPGSSH 'sign commits using literal public keys with ssh-agent' '
+       test_when_finished "test_unconfig commit.gpgsign" &&
+       test_config gpg.format ssh &&
+       eval $(ssh-agent) &&
+       test_when_finished "kill ${SSH_AGENT_PID}" &&
+       ssh-add "${GPGSSH_KEY_PRIMARY}" &&
+       echo 1 >file && git add file &&
+       git commit -a -m rsa-inline -S"$(cat "${GPGSSH_KEY_PRIMARY}.pub")" &&
+       echo 2 >file &&
+       test_config user.signingkey "$(cat "${GPGSSH_KEY_PRIMARY}.pub")" &&
+       git commit -a -m rsa-config -S &&
+       ssh-add "${GPGSSH_KEY_ECDSA}" &&
+       echo 3 >file &&
+       git commit -a -m ecdsa-inline -S"key::$(cat "${GPGSSH_KEY_ECDSA}.pub")" &&
+       echo 4 >file &&
+       test_config user.signingkey "key::$(cat "${GPGSSH_KEY_ECDSA}.pub")" &&
+       git commit -a -m ecdsa-config -S
+'
+
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'create signed commits with keys having defined lifetimes' '
+       test_when_finished "test_unconfig commit.gpgsign" &&
+       test_config gpg.format ssh &&
+
+       echo expired >file && test_tick && git commit -a -m expired -S"${GPGSSH_KEY_EXPIRED}" &&
+       git tag expired-signed &&
+
+       echo notyetvalid >file && test_tick && git commit -a -m notyetvalid -S"${GPGSSH_KEY_NOTYETVALID}" &&
+       git tag notyetvalid-signed &&
+
+       echo timeboxedvalid >file && test_tick && git commit -a -m timeboxedvalid -S"${GPGSSH_KEY_TIMEBOXEDVALID}" &&
+       git tag timeboxedvalid-signed &&
+
+       echo timeboxedinvalid >file && test_tick && git commit -a -m timeboxedinvalid -S"${GPGSSH_KEY_TIMEBOXEDINVALID}" &&
+       git tag timeboxedinvalid-signed
 '
 
 test_expect_success GPGSSH 'verify and show signatures' '
@@ -122,6 +161,31 @@ test_expect_success GPGSSH 'verify-commit exits failure on untrusted signature'
        grep "${GPGSSH_KEY_NOT_TRUSTED}" actual
 '
 
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-commit exits failure on expired signature key' '
+       test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
+       test_must_fail git verify-commit expired-signed 2>actual &&
+       ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
+'
+
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-commit exits failure on not yet valid signature key' '
+       test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
+       test_must_fail git verify-commit notyetvalid-signed 2>actual &&
+       ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
+'
+
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-commit succeeds with commit date and key validity matching' '
+       test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
+       git verify-commit timeboxedvalid-signed 2>actual &&
+       grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
+       ! grep "${GPGSSH_BAD_SIGNATURE}" actual
+'
+
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'verify-commit exits failure with commit date outside of key validity' '
+       test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
+       test_must_fail git verify-commit timeboxedinvalid-signed 2>actual &&
+       ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
+'
+
 test_expect_success GPGSSH 'verify-commit exits success with matching minTrustLevel' '
        test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
        test_config gpg.minTrustLevel fully &&
@@ -217,7 +281,7 @@ test_expect_success GPGSSH 'amending already signed commit' '
        test_config gpg.format ssh &&
        test_config user.signingkey "${GPGSSH_KEY_PRIMARY}" &&
        test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
-       git checkout fourth-signed^0 &&
+       git checkout -f fourth-signed^0 &&
        git commit --amend -S --no-edit &&
        git verify-commit HEAD &&
        git show -s --show-signature HEAD >actual &&