[thirdparty/git.git] / gpg-interface.c

#include "cache.h"
#include "commit.h"
#include "config.h"
#include "run-command.h"
#include "strbuf.h"
#include "gpg-interface.h"
#include "sigchain.h"
#include "tempfile.h"

static char *configured_signing_key;
static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;

struct gpg_format {
	const char *name;
	const char *program;
	const char **verify_args;
	const char **sigs;
	int (*verify_signed_buffer)(struct signature_check *sigc,
				    struct gpg_format *fmt, const char *payload,
				    size_t payload_size, const char *signature,
				    size_t signature_size);
	int (*sign_buffer)(struct strbuf *buffer, struct strbuf *signature,
			   const char *signing_key);
};

static const char *openpgp_verify_args[] = {
	"--keyid-format=long",
	NULL
};
static const char *openpgp_sigs[] = {
	"-----BEGIN PGP SIGNATURE-----",
	"-----BEGIN PGP MESSAGE-----",
	NULL
};

static const char *x509_verify_args[] = {
	NULL
};
static const char *x509_sigs[] = {
	"-----BEGIN SIGNED MESSAGE-----",
	NULL
};

static int verify_gpg_signed_buffer(struct signature_check *sigc,
				    struct gpg_format *fmt, const char *payload,
				    size_t payload_size, const char *signature,
				    size_t signature_size);
static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
			   const char *signing_key);

static struct gpg_format gpg_format[] = {
	{
		.name = "openpgp",
		.program = "gpg",
		.verify_args = openpgp_verify_args,
		.sigs = openpgp_sigs,
		.verify_signed_buffer = verify_gpg_signed_buffer,
		.sign_buffer = sign_buffer_gpg,
	},
	{
		.name = "x509",
		.program = "gpgsm",
		.verify_args = x509_verify_args,
		.sigs = x509_sigs,
		.verify_signed_buffer = verify_gpg_signed_buffer,
		.sign_buffer = sign_buffer_gpg,
	},
};

static struct gpg_format *use_format = &gpg_format[0];

static struct gpg_format *get_format_by_name(const char *str)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		if (!strcmp(gpg_format[i].name, str))
			return gpg_format + i;
	return NULL;
}

static struct gpg_format *get_format_by_sig(const char *sig)
{
	int i, j;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		for (j = 0; gpg_format[i].sigs[j]; j++)
			if (starts_with(sig, gpg_format[i].sigs[j]))
				return gpg_format + i;
	return NULL;
}

void signature_check_clear(struct signature_check *sigc)
{
	FREE_AND_NULL(sigc->payload);
	FREE_AND_NULL(sigc->output);
	FREE_AND_NULL(sigc->gpg_status);
	FREE_AND_NULL(sigc->signer);
	FREE_AND_NULL(sigc->key);
	FREE_AND_NULL(sigc->fingerprint);
	FREE_AND_NULL(sigc->primary_key_fingerprint);
}

/* An exclusive status -- only one of them can appear in output */
#define GPG_STATUS_EXCLUSIVE	(1<<0)
/* The status includes key identifier */
#define GPG_STATUS_KEYID	(1<<1)
/* The status includes user identifier */
#define GPG_STATUS_UID		(1<<2)
/* The status includes key fingerprints */
#define GPG_STATUS_FINGERPRINT	(1<<3)
/* The status includes trust level */
#define GPG_STATUS_TRUST_LEVEL	(1<<4)

/* Short-hand for standard exclusive *SIG status with keyid & UID */
#define GPG_STATUS_STDSIG	(GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)

static struct {
	char result;
	const char *check;
	unsigned int flags;
} sigcheck_gpg_status[] = {
	{ 'G', "GOODSIG ", GPG_STATUS_STDSIG },
	{ 'B', "BADSIG ", GPG_STATUS_STDSIG },
	{ 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID },
	{ 'X', "EXPSIG ", GPG_STATUS_STDSIG },
	{ 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
	{ 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
	{ 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
	{ 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
};

static struct {
	const char *key;
	enum signature_trust_level value;
} sigcheck_gpg_trust_level[] = {
	{ "UNDEFINED", TRUST_UNDEFINED },
	{ "NEVER", TRUST_NEVER },
	{ "MARGINAL", TRUST_MARGINAL },
	{ "FULLY", TRUST_FULLY },
	{ "ULTIMATE", TRUST_ULTIMATE },
};

static void replace_cstring(char **field, const char *line, const char *next)
{
	free(*field);

	if (line && next)
		*field = xmemdupz(line, next - line);
	else
		*field = NULL;
}

static int parse_gpg_trust_level(const char *level,
				 enum signature_trust_level *res)
{
	size_t i;

	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
		if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
			*res = sigcheck_gpg_trust_level[i].value;
			return 0;
		}
	}
	return 1;
}

static void parse_gpg_output(struct signature_check *sigc)
{
	const char *buf = sigc->gpg_status;
	const char *line, *next;
	int i, j;
	int seen_exclusive_status = 0;

	/* Iterate over all lines */
	for (line = buf; *line; line = strchrnul(line+1, '\n')) {
		while (*line == '\n')
			line++;
		if (!*line)
			break;

		/* Skip lines that don't start with GNUPG status */
		if (!skip_prefix(line, "[GNUPG:] ", &line))
			continue;

		/* Iterate over all search strings */
		for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
			if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
				/*
				 * GOODSIG, BADSIG etc. can occur only once for
				 * each signature.  Therefore, if we had more
				 * than one then we're dealing with multiple
				 * signatures.  We don't support them
				 * currently, and they're rather hard to
				 * create, so something is likely fishy and we
				 * should reject them altogether.
				 */
				if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
					if (seen_exclusive_status++)
						goto error;
				}

				if (sigcheck_gpg_status[i].result)
					sigc->result = sigcheck_gpg_status[i].result;
				/* Do we have key information? */
				if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
					next = strchrnul(line, ' ');
					replace_cstring(&sigc->key, line, next);
					/* Do we have signer information? */
					if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
						line = next + 1;
						next = strchrnul(line, '\n');
						replace_cstring(&sigc->signer, line, next);
					}
				}

				/* Do we have trust level? */
				if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
					/*
					 * GPG v1 and v2 differs in how the
					 * TRUST_ lines are written.  Some
					 * trust lines contain no additional
					 * space-separated information for v1.
					 */
					size_t trust_size = strcspn(line, " \n");
					char *trust = xmemdupz(line, trust_size);

					if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
						free(trust);
						goto error;
					}
					free(trust);
				}

				/* Do we have fingerprint? */
				if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
					const char *limit;
					char **field;

					next = strchrnul(line, ' ');
					replace_cstring(&sigc->fingerprint, line, next);

					/*
					 * Skip interim fields.  The search is
					 * limited to the same line since only
					 * OpenPGP signatures has a field with
					 * the primary fingerprint.
					 */
					limit = strchrnul(line, '\n');
					for (j = 9; j > 0; j--) {
						if (!*next || limit <= next)
							break;
						line = next + 1;
						next = strchrnul(line, ' ');
					}

					field = &sigc->primary_key_fingerprint;
					if (!j) {
						next = strchrnul(line, '\n');
						replace_cstring(field, line, next);
					} else {
						replace_cstring(field, NULL, NULL);
					}
				}

				break;
			}
		}
	}
	return;

error:
	sigc->result = 'E';
	/* Clear partial data to avoid confusion */
	FREE_AND_NULL(sigc->primary_key_fingerprint);
	FREE_AND_NULL(sigc->fingerprint);
	FREE_AND_NULL(sigc->signer);
	FREE_AND_NULL(sigc->key);
}

static int verify_gpg_signed_buffer(struct signature_check *sigc,
				    struct gpg_format *fmt, const char *payload,
				    size_t payload_size, const char *signature,
				    size_t signature_size)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	struct tempfile *temp;
	int ret;
	struct strbuf gpg_stdout = STRBUF_INIT;
	struct strbuf gpg_stderr = STRBUF_INIT;

	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
	if (!temp)
		return error_errno(_("could not create temporary file"));
	if (write_in_full(temp->fd, signature, signature_size) < 0 ||
	    close_tempfile_gently(temp) < 0) {
		error_errno(_("failed writing detached signature to '%s'"),
			    temp->filename.buf);
		delete_tempfile(&temp);
		return -1;
	}

	strvec_push(&gpg.args, fmt->program);
	strvec_pushv(&gpg.args, fmt->verify_args);
	strvec_pushl(&gpg.args,
		     "--status-fd=1",
		     "--verify", temp->filename.buf, "-",
		     NULL);

	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, payload, payload_size, &gpg_stdout, 0,
			   &gpg_stderr, 0);
	sigchain_pop(SIGPIPE);

	delete_tempfile(&temp);

	ret |= !strstr(gpg_stdout.buf, "\n[GNUPG:] GOODSIG ");
	sigc->payload = xmemdupz(payload, payload_size);
	sigc->output = strbuf_detach(&gpg_stderr, NULL);
	sigc->gpg_status = strbuf_detach(&gpg_stdout, NULL);

	parse_gpg_output(sigc);

	strbuf_release(&gpg_stdout);
	strbuf_release(&gpg_stderr);

	return ret;
}

int check_signature(const char *payload, size_t plen, const char *signature,
	size_t slen, struct signature_check *sigc)
{
	struct gpg_format *fmt;
	int status;

	sigc->result = 'N';
	sigc->trust_level = -1;

	fmt = get_format_by_sig(signature);
	if (!fmt)
		die(_("bad/incompatible signature '%s'"), signature);

	status = fmt->verify_signed_buffer(sigc, fmt, payload, plen, signature,
					   slen);

	if (status && !sigc->output)
		return !!status;

	status |= sigc->result != 'G';
	status |= sigc->trust_level < configured_min_trust_level;

	return !!status;
}

void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
{
	const char *output = flags & GPG_VERIFY_RAW ? sigc->gpg_status :
							    sigc->output;

	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
		fputs(sigc->payload, stdout);

	if (output)
		fputs(output, stderr);
}

size_t parse_signed_buffer(const char *buf, size_t size)
{
	size_t len = 0;
	size_t match = size;
	while (len < size) {
		const char *eol;

		if (get_format_by_sig(buf + len))
			match = len;

		eol = memchr(buf + len, '\n', size - len);
		len += eol ? eol - (buf + len) + 1 : size - len;
	}
	return match;
}

int parse_signature(const char *buf, size_t size, struct strbuf *payload, struct strbuf *signature)
{
	size_t match = parse_signed_buffer(buf, size);
	if (match != size) {
		strbuf_add(payload, buf, match);
		remove_signature(payload);
		strbuf_add(signature, buf + match, size - match);
		return 1;
	}
	return 0;
}

void set_signing_key(const char *key)
{
	free(configured_signing_key);
	configured_signing_key = xstrdup(key);
}

int git_gpg_config(const char *var, const char *value, void *cb)
{
	struct gpg_format *fmt = NULL;
	char *fmtname = NULL;
	char *trust;
	int ret;

	if (!strcmp(var, "user.signingkey")) {
		if (!value)
			return config_error_nonbool(var);
		set_signing_key(value);
		return 0;
	}

	if (!strcmp(var, "gpg.format")) {
		if (!value)
			return config_error_nonbool(var);
		fmt = get_format_by_name(value);
		if (!fmt)
			return error("unsupported value for %s: %s",
				     var, value);
		use_format = fmt;
		return 0;
	}

	if (!strcmp(var, "gpg.mintrustlevel")) {
		if (!value)
			return config_error_nonbool(var);

		trust = xstrdup_toupper(value);
		ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
		free(trust);

		if (ret)
			return error("unsupported value for %s: %s", var,
				     value);
		return 0;
	}

	if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
		fmtname = "openpgp";

	if (!strcmp(var, "gpg.x509.program"))
		fmtname = "x509";

	if (fmtname) {
		fmt = get_format_by_name(fmtname);
		return git_config_string(&fmt->program, var, value);
	}

	return 0;
}

const char *get_signing_key(void)
{
	if (configured_signing_key)
		return configured_signing_key;
	return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
}

int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
{
	return use_format->sign_buffer(buffer, signature, signing_key);
}

static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
			  const char *signing_key)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	int ret;
	size_t i, j, bottom;
	struct strbuf gpg_status = STRBUF_INIT;

	strvec_pushl(&gpg.args,
		     use_format->program,
		     "--status-fd=2",
		     "-bsau", signing_key,
		     NULL);

	bottom = signature->len;

	/*
	 * When the username signingkey is bad, program could be terminated
	 * because gpg exits without reading and then write gets SIGPIPE.
	 */
	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, buffer->buf, buffer->len,
			   signature, 1024, &gpg_status, 0);
	sigchain_pop(SIGPIPE);

	ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	strbuf_release(&gpg_status);
	if (ret)
		return error(_("gpg failed to sign the data"));

	/* Strip CR from the line endings, in case we are on Windows. */
	for (i = j = bottom; i < signature->len; i++)
		if (signature->buf[i] != '\r') {
			if (i != j)
				signature->buf[j] = signature->buf[i];
			j++;
		}
	strbuf_setlen(signature, j);

	return 0;
}
Commit	Line	Data
2f47eae2	1	#include "cache.h"
9b27b492	2	#include "commit.h"
b2141fc1	3	#include "config.h"
2f47eae2 JH	4	#include "run-command.h"
	5	#include "strbuf.h"
	6	#include "gpg-interface.h"
	7	#include "sigchain.h"
4322353b	8	#include "tempfile.h"
2f47eae2 JH	9
2f47eae2 JH	10	static char *configured_signing_key;
54887b46 HJI	11	static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;
54887b46 HJI	12
58af57e1 HS	13	struct gpg_format {
	14	const char *name;
	15	const char *program;
	16	const char **verify_args;
	17	const char **sigs;
b5726a5d FS	18	int (verify_signed_buffer)(struct signature_check sigc,
	19	struct gpg_format fmt, const char payload,
	20	size_t payload_size, const char *signature,
	21	size_t signature_size);
	22	int (sign_buffer)(struct strbuf buffer, struct strbuf *signature,
	23	const char *signing_key);
58af57e1 HS	24	};
	25
	26	static const char *openpgp_verify_args[] = {
	27	"--keyid-format=long",
	28	NULL
	29	};
	30	static const char *openpgp_sigs[] = {
	31	"-----BEGIN PGP SIGNATURE-----",
	32	"-----BEGIN PGP MESSAGE-----",
	33	NULL
	34	};
	35
1e7adb97 HS	36	static const char *x509_verify_args[] = {
	37	NULL
	38	};
	39	static const char *x509_sigs[] = {
	40	"-----BEGIN SIGNED MESSAGE-----",
	41	NULL
	42	};
	43
b5726a5d FS	44	static int verify_gpg_signed_buffer(struct signature_check *sigc,
	45	struct gpg_format fmt, const char payload,
	46	size_t payload_size, const char *signature,
	47	size_t signature_size);
	48	static int sign_buffer_gpg(struct strbuf buffer, struct strbuf signature,
	49	const char *signing_key);
	50
58af57e1	51	static struct gpg_format gpg_format[] = {
b5726a5d FS	52	{
	53	.name = "openpgp",
	54	.program = "gpg",
	55	.verify_args = openpgp_verify_args,
	56	.sigs = openpgp_sigs,
	57	.verify_signed_buffer = verify_gpg_signed_buffer,
	58	.sign_buffer = sign_buffer_gpg,
58af57e1	59	},
b5726a5d FS	60	{
	61	.name = "x509",
	62	.program = "gpgsm",
	63	.verify_args = x509_verify_args,
	64	.sigs = x509_sigs,
	65	.verify_signed_buffer = verify_gpg_signed_buffer,
	66	.sign_buffer = sign_buffer_gpg,
1e7adb97	67	},
58af57e1 HS	68	};
	69
	70	static struct gpg_format *use_format = &gpg_format[0];
2f47eae2	71
58af57e1 HS	72	static struct gpg_format get_format_by_name(const char str)
	73	{
	74	int i;
	75
	76	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	77	if (!strcmp(gpg_format[i].name, str))
	78	return gpg_format + i;
	79	return NULL;
	80	}
	81
	82	static struct gpg_format get_format_by_sig(const char sig)
	83	{
	84	int i, j;
	85
	86	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	87	for (j = 0; gpg_format[i].sigs[j]; j++)
	88	if (starts_with(sig, gpg_format[i].sigs[j]))
	89	return gpg_format + i;
	90	return NULL;
	91	}
d7c67668	92
01e57b5d MG	93	void signature_check_clear(struct signature_check *sigc)
01e57b5d MG	94	{
88ce3ef6	95	FREE_AND_NULL(sigc->payload);
b5726a5d	96	FREE_AND_NULL(sigc->output);
88ce3ef6 ÆAB	97	FREE_AND_NULL(sigc->gpg_status);
	98	FREE_AND_NULL(sigc->signer);
	99	FREE_AND_NULL(sigc->key);
3daaaabe	100	FREE_AND_NULL(sigc->fingerprint);
4de9394d	101	FREE_AND_NULL(sigc->primary_key_fingerprint);
01e57b5d MG	102	}
01e57b5d MG	103
da6cf1b3 MG	104	/* An exclusive status -- only one of them can appear in output */
da6cf1b3 MG	105	#define GPG_STATUS_EXCLUSIVE (1<<0)
0b11a84e MG	106	/* The status includes key identifier */
	107	#define GPG_STATUS_KEYID (1<<1)
	108	/* The status includes user identifier */
	109	#define GPG_STATUS_UID (1<<2)
3daaaabe MG	110	/* The status includes key fingerprints */
3daaaabe MG	111	#define GPG_STATUS_FINGERPRINT (1<<3)
54887b46 HJI	112	/* The status includes trust level */
54887b46 HJI	113	#define GPG_STATUS_TRUST_LEVEL (1<<4)
0b11a84e MG	114
	115	/* Short-hand for standard exclusive SIG status with keyid & UID /
	116	#define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE\|GPG_STATUS_KEYID\|GPG_STATUS_UID)
da6cf1b3	117
a50e7ca3 JH	118	static struct {
	119	char result;
	120	const char *check;
da6cf1b3	121	unsigned int flags;
a50e7ca3	122	} sigcheck_gpg_status[] = {
0b11a84e MG	123	{ 'G', "GOODSIG ", GPG_STATUS_STDSIG },
0b11a84e MG	124	{ 'B', "BADSIG ", GPG_STATUS_STDSIG },
0b11a84e MG	125	{ 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE\|GPG_STATUS_KEYID },
	126	{ 'X', "EXPSIG ", GPG_STATUS_STDSIG },
	127	{ 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
	128	{ 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
3daaaabe	129	{ 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
54887b46 HJI	130	{ 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
	131	};
	132
	133	static struct {
	134	const char *key;
	135	enum signature_trust_level value;
	136	} sigcheck_gpg_trust_level[] = {
	137	{ "UNDEFINED", TRUST_UNDEFINED },
	138	{ "NEVER", TRUST_NEVER },
	139	{ "MARGINAL", TRUST_MARGINAL },
	140	{ "FULLY", TRUST_FULLY },
	141	{ "ULTIMATE", TRUST_ULTIMATE },
a50e7ca3 JH	142	};
a50e7ca3 JH	143
392b862e HJI	144	static void replace_cstring(char *field, const char line, const char *next)
	145	{
	146	free(*field);
	147
	148	if (line && next)
	149	*field = xmemdupz(line, next - line);
	150	else
	151	*field = NULL;
	152	}
	153
54887b46 HJI	154	static int parse_gpg_trust_level(const char *level,
	155	enum signature_trust_level *res)
	156	{
	157	size_t i;
	158
	159	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
	160	if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
	161	*res = sigcheck_gpg_trust_level[i].value;
	162	return 0;
	163	}
	164	}
	165	return 1;
	166	}
	167
fbd0f166	168	static void parse_gpg_output(struct signature_check *sigc)
a50e7ca3 JH	169	{
a50e7ca3 JH	170	const char *buf = sigc->gpg_status;
da6cf1b3	171	const char line, next;
4de9394d	172	int i, j;
da6cf1b3 MG	173	int seen_exclusive_status = 0;
	174
	175	/* Iterate over all lines */
	176	for (line = buf; *line; line = strchrnul(line+1, '\n')) {
	177	while (*line == '\n')
	178	line++;
64c45dc7 SR	179	if (!*line)
	180	break;
	181
da6cf1b3 MG	182	/* Skip lines that don't start with GNUPG status */
	183	if (!skip_prefix(line, "[GNUPG:] ", &line))
	184	continue;
	185
	186	/* Iterate over all search strings */
	187	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
	188	if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
54887b46 HJI	189	/*
	190	* GOODSIG, BADSIG etc. can occur only once for
	191	* each signature. Therefore, if we had more
	192	* than one then we're dealing with multiple
	193	* signatures. We don't support them
	194	* currently, and they're rather hard to
	195	* create, so something is likely fishy and we
	196	* should reject them altogether.
	197	*/
da6cf1b3	198	if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
02561896	199	if (seen_exclusive_status++)
54887b46	200	goto error;
da6cf1b3 MG	201	}
da6cf1b3 MG	202
3daaaabe MG	203	if (sigcheck_gpg_status[i].result)
3daaaabe MG	204	sigc->result = sigcheck_gpg_status[i].result;
0b11a84e MG	205	/* Do we have key information? */
0b11a84e MG	206	if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
da6cf1b3	207	next = strchrnul(line, ' ');
392b862e	208	replace_cstring(&sigc->key, line, next);
0b11a84e MG	209	/* Do we have signer information? */
0b11a84e MG	210	if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
da6cf1b3 MG	211	line = next + 1;
da6cf1b3 MG	212	next = strchrnul(line, '\n');
392b862e	213	replace_cstring(&sigc->signer, line, next);
da6cf1b3 MG	214	}
da6cf1b3 MG	215	}
54887b46 HJI	216
	217	/* Do we have trust level? */
	218	if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
	219	/*
	220	* GPG v1 and v2 differs in how the
	221	* TRUST_ lines are written. Some
	222	* trust lines contain no additional
	223	* space-separated information for v1.
	224	*/
	225	size_t trust_size = strcspn(line, " \n");
	226	char *trust = xmemdupz(line, trust_size);
	227
	228	if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
	229	free(trust);
	230	goto error;
	231	}
	232	free(trust);
	233	}
	234
3daaaabe MG	235	/* Do we have fingerprint? */
3daaaabe MG	236	if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
67a6ea63 HJI	237	const char *limit;
	238	char **field;
	239
3daaaabe	240	next = strchrnul(line, ' ');
392b862e	241	replace_cstring(&sigc->fingerprint, line, next);
4de9394d	242
67a6ea63 HJI	243	/*
	244	* Skip interim fields. The search is
	245	* limited to the same line since only
	246	* OpenPGP signatures has a field with
	247	* the primary fingerprint.
	248	*/
	249	limit = strchrnul(line, '\n');
4de9394d	250	for (j = 9; j > 0; j--) {
67a6ea63	251	if (!*next \|\| limit <= next)
4de9394d MG	252	break;
	253	line = next + 1;
	254	next = strchrnul(line, ' ');
	255	}
	256
67a6ea63 HJI	257	field = &sigc->primary_key_fingerprint;
	258	if (!j) {
	259	next = strchrnul(line, '\n');
	260	replace_cstring(field, line, next);
	261	} else {
	262	replace_cstring(field, NULL, NULL);
	263	}
3daaaabe	264	}
da6cf1b3 MG	265
da6cf1b3 MG	266	break;
661a1806	267	}
a50e7ca3 JH	268	}
a50e7ca3 JH	269	}
da6cf1b3 MG	270	return;
da6cf1b3 MG	271
54887b46	272	error:
da6cf1b3 MG	273	sigc->result = 'E';
da6cf1b3 MG	274	/* Clear partial data to avoid confusion */
4de9394d	275	FREE_AND_NULL(sigc->primary_key_fingerprint);
3daaaabe	276	FREE_AND_NULL(sigc->fingerprint);
da6cf1b3 MG	277	FREE_AND_NULL(sigc->signer);
da6cf1b3 MG	278	FREE_AND_NULL(sigc->key);
a50e7ca3 JH	279	}
a50e7ca3 JH	280
b5726a5d FS	281	static int verify_gpg_signed_buffer(struct signature_check *sigc,
	282	struct gpg_format fmt, const char payload,
	283	size_t payload_size, const char *signature,
	284	size_t signature_size)
67948981 HJI	285	{
67948981 HJI	286	struct child_process gpg = CHILD_PROCESS_INIT;
67948981 HJI	287	struct tempfile *temp;
67948981 HJI	288	int ret;
b5726a5d FS	289	struct strbuf gpg_stdout = STRBUF_INIT;
b5726a5d FS	290	struct strbuf gpg_stderr = STRBUF_INIT;
67948981 HJI	291
	292	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
	293	if (!temp)
	294	return error_errno(_("could not create temporary file"));
	295	if (write_in_full(temp->fd, signature, signature_size) < 0 \|\|
	296	close_tempfile_gently(temp) < 0) {
	297	error_errno(_("failed writing detached signature to '%s'"),
	298	temp->filename.buf);
	299	delete_tempfile(&temp);
	300	return -1;
	301	}
	302
ef8d7ac4 JK	303	strvec_push(&gpg.args, fmt->program);
	304	strvec_pushv(&gpg.args, fmt->verify_args);
	305	strvec_pushl(&gpg.args,
f6d8942b JK	306	"--status-fd=1",
	307	"--verify", temp->filename.buf, "-",
	308	NULL);
67948981	309
67948981	310	sigchain_push(SIGPIPE, SIG_IGN);
b5726a5d FS	311	ret = pipe_command(&gpg, payload, payload_size, &gpg_stdout, 0,
b5726a5d FS	312	&gpg_stderr, 0);
67948981 HJI	313	sigchain_pop(SIGPIPE);
	314
	315	delete_tempfile(&temp);
	316
b5726a5d FS	317	ret \|= !strstr(gpg_stdout.buf, "\n[GNUPG:] GOODSIG ");
	318	sigc->payload = xmemdupz(payload, payload_size);
	319	sigc->output = strbuf_detach(&gpg_stderr, NULL);
	320	sigc->gpg_status = strbuf_detach(&gpg_stdout, NULL);
	321
	322	parse_gpg_output(sigc);
	323
	324	strbuf_release(&gpg_stdout);
	325	strbuf_release(&gpg_stderr);
67948981 HJI	326
	327	return ret;
	328	}
	329
434060ec	330	int check_signature(const char payload, size_t plen, const char signature,
a4cc18f2	331	size_t slen, struct signature_check *sigc)
a4cc18f2	332	{
b5726a5d	333	struct gpg_format *fmt;
a4cc18f2	334	int status;
	335
	336	sigc->result = 'N';
54887b46	337	sigc->trust_level = -1;
a4cc18f2	338
b5726a5d FS	339	fmt = get_format_by_sig(signature);
	340	if (!fmt)
	341	die(_("bad/incompatible signature '%s'"), signature);
	342
	343	status = fmt->verify_signed_buffer(sigc, fmt, payload, plen, signature,
	344	slen);
	345
	346	if (status && !sigc->output)
	347	return !!status;
	348
54887b46 HJI	349	status \|= sigc->result != 'G';
54887b46 HJI	350	status \|= sigc->trust_level < configured_min_trust_level;
a4cc18f2	351
4e5dc9ca	352	return !!status;
a4cc18f2	353	}
a4cc18f2	354
ca194d50	355	void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
ca194d50	356	{
b5726a5d FS	357	const char *output = flags & GPG_VERIFY_RAW ? sigc->gpg_status :
b5726a5d FS	358	sigc->output;
aeff29dd	359
ca194d50	360	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
	361	fputs(sigc->payload, stdout);
	362
aeff29dd	363	if (output)
aeff29dd	364	fputs(output, stderr);
ca194d50	365	}
ca194d50	366
482c1191	367	size_t parse_signed_buffer(const char *buf, size_t size)
d7c67668	368	{
d7c67668	369	size_t len = 0;
8b44b2be JK	370	size_t match = size;
	371	while (len < size) {
	372	const char *eol;
	373
58af57e1	374	if (get_format_by_sig(buf + len))
8b44b2be JK	375	match = len;
	376
	377	eol = memchr(buf + len, '\n', size - len);
d7c67668 JH	378	len += eol ? eol - (buf + len) + 1 : size - len;
d7c67668 JH	379	}
8b44b2be	380	return match;
d7c67668 JH	381	}
d7c67668 JH	382
482c1191	383	int parse_signature(const char buf, size_t size, struct strbuf payload, struct strbuf *signature)
	384	{
	385	size_t match = parse_signed_buffer(buf, size);
	386	if (match != size) {
	387	strbuf_add(payload, buf, match);
9b27b492	388	remove_signature(payload);
482c1191	389	strbuf_add(signature, buf + match, size - match);
	390	return 1;
	391	}
	392	return 0;
	393	}
	394
2f47eae2 JH	395	void set_signing_key(const char *key)
	396	{
	397	free(configured_signing_key);
	398	configured_signing_key = xstrdup(key);
	399	}
	400
	401	int git_gpg_config(const char var, const char value, void *cb)
	402	{
58af57e1 HS	403	struct gpg_format *fmt = NULL;
58af57e1 HS	404	char *fmtname = NULL;
54887b46 HJI	405	char *trust;
54887b46 HJI	406	int ret;
58af57e1	407
2f47eae2	408	if (!strcmp(var, "user.signingkey")) {
1b0eeec3 JK	409	if (!value)
1b0eeec3 JK	410	return config_error_nonbool(var);
0c5e70f0	411	set_signing_key(value);
1b0eeec3	412	return 0;
0c5e70f0	413	}
1b0eeec3	414
57a8dd75 HS	415	if (!strcmp(var, "gpg.format")) {
	416	if (!value)
	417	return config_error_nonbool(var);
58af57e1 HS	418	fmt = get_format_by_name(value);
58af57e1 HS	419	if (!fmt)
57a8dd75 HS	420	return error("unsupported value for %s: %s",
57a8dd75 HS	421	var, value);
58af57e1 HS	422	use_format = fmt;
58af57e1 HS	423	return 0;
57a8dd75 HS	424	}
57a8dd75 HS	425
54887b46 HJI	426	if (!strcmp(var, "gpg.mintrustlevel")) {
	427	if (!value)
	428	return config_error_nonbool(var);
	429
	430	trust = xstrdup_toupper(value);
	431	ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
	432	free(trust);
	433
	434	if (ret)
	435	return error("unsupported value for %s: %s", var,
	436	value);
	437	return 0;
	438	}
	439
b02f51b1	440	if (!strcmp(var, "gpg.program") \|\| !strcmp(var, "gpg.openpgp.program"))
58af57e1 HS	441	fmtname = "openpgp";
58af57e1 HS	442
1e7adb97 HS	443	if (!strcmp(var, "gpg.x509.program"))
	444	fmtname = "x509";
	445
58af57e1 HS	446	if (fmtname) {
	447	fmt = get_format_by_name(fmtname);
	448	return git_config_string(&fmt->program, var, value);
2f47eae2	449	}
1b0eeec3	450
2f47eae2 JH	451	return 0;
	452	}
	453
	454	const char *get_signing_key(void)
	455	{
	456	if (configured_signing_key)
	457	return configured_signing_key;
f9bc573f	458	return git_committer_info(IDENT_STRICT\|IDENT_NO_DATE);
2f47eae2 JH	459	}
2f47eae2 JH	460
2f47eae2	461	int sign_buffer(struct strbuf buffer, struct strbuf signature, const char *signing_key)
b5726a5d FS	462	{
	463	return use_format->sign_buffer(buffer, signature, signing_key);
	464	}
	465
	466	static int sign_buffer_gpg(struct strbuf buffer, struct strbuf signature,
	467	const char *signing_key)
2f47eae2	468	{
d3180279	469	struct child_process gpg = CHILD_PROCESS_INIT;
0581b546	470	int ret;
2f47eae2	471	size_t i, j, bottom;
efee9553	472	struct strbuf gpg_status = STRBUF_INIT;
2f47eae2	473
ef8d7ac4	474	strvec_pushl(&gpg.args,
f6d8942b JK	475	use_format->program,
	476	"--status-fd=2",
	477	"-bsau", signing_key,
	478	NULL);
2f47eae2	479
0581b546	480	bottom = signature->len;
2f47eae2 JH	481
	482	/*
	483	* When the username signingkey is bad, program could be terminated
	484	* because gpg exits without reading and then write gets SIGPIPE.
	485	*/
	486	sigchain_push(SIGPIPE, SIG_IGN);
0581b546	487	ret = pipe_command(&gpg, buffer->buf, buffer->len,
efee9553	488	signature, 1024, &gpg_status, 0);
2f47eae2 JH	489	sigchain_pop(SIGPIPE);
2f47eae2 JH	490
efee9553 MG	491	ret \|= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	492	strbuf_release(&gpg_status);
	493	if (ret)
2f47eae2 JH	494	return error(_("gpg failed to sign the data"));
	495
	496	/* Strip CR from the line endings, in case we are on Windows. */
	497	for (i = j = bottom; i < signature->len; i++)
	498	if (signature->buf[i] != '\r') {
	499	if (i != j)
	500	signature->buf[j] = signature->buf[i];
	501	j++;
	502	}
	503	strbuf_setlen(signature, j);
	504
	505	return 0;
	506	}