t/t7031-verify-tag-signed-ssh.sh

   1 #!/bin/sh
   2
   3 test_description='signed tag tests'
   4 GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
   5 export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
   6
   7 . ./test-lib.sh
   8 . "$TEST_DIRECTORY/lib-gpg.sh"
   9
  10 test_expect_success GPGSSH 'create signed tags ssh' '
  11         test_when_finished "test_unconfig commit.gpgsign" &&
  12         test_config gpg.format ssh &&
  13         test_config user.signingkey "${GPGSSH_KEY_PRIMARY}" &&
  14
  15         echo 1 >file && git add file &&
  16         test_tick && git commit -m initial &&
  17         git tag -s -m initial initial &&
  18         git branch side &&
  19
  20         echo 2 >file && test_tick && git commit -a -m second &&
  21         git tag -s -m second second &&
  22
  23         git checkout side &&
  24         echo 3 >elif && git add elif &&
  25         test_tick && git commit -m "third on side" &&
  26
  27         git checkout main &&
  28         test_tick && git merge -S side &&
  29         git tag -s -m merge merge &&
  30
  31         echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" &&
  32         git tag -a -m fourth-unsigned fourth-unsigned &&
  33
  34         test_tick && git commit --amend -S -m "fourth signed" &&
  35         git tag -s -m fourth fourth-signed &&
  36
  37         echo 5 >file && test_tick && git commit -a -m "fifth" &&
  38         git tag fifth-unsigned &&
  39
  40         git config commit.gpgsign true &&
  41         echo 6 >file && test_tick && git commit -a -m "sixth" &&
  42         git tag -a -m sixth sixth-unsigned &&
  43
  44         test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ &&
  45         git tag -m seventh -s seventh-signed &&
  46
  47         echo 8 >file && test_tick && git commit -a -m eighth &&
  48         git tag -u"${GPGSSH_KEY_UNTRUSTED}" -m eighth eighth-signed-alt
  49 '
  50
  51 test_expect_success GPGSSH 'verify and show ssh signatures' '
  52         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
  53         (
  54                 for tag in initial second merge fourth-signed sixth-signed seventh-signed
  55                 do
  56                         git verify-tag $tag 2>actual &&
  57                         grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
  58                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
  59                         echo $tag OK || exit 1
  60                 done
  61         ) &&
  62         (
  63                 for tag in fourth-unsigned fifth-unsigned sixth-unsigned
  64                 do
  65                         test_must_fail git verify-tag $tag 2>actual &&
  66                         ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
  67                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
  68                         echo $tag OK || exit 1
  69                 done
  70         ) &&
  71         (
  72                 for tag in eighth-signed-alt
  73                 do
  74                         test_must_fail git verify-tag $tag 2>actual &&
  75                         grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual &&
  76                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
  77                         grep "${GPGSSH_KEY_NOT_TRUSTED}" actual &&
  78                         echo $tag OK || exit 1
  79                 done
  80         )
  81 '
  82
  83 test_expect_success GPGSSH 'detect fudged ssh signature' '
  84         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
  85         git cat-file tag seventh-signed >raw &&
  86         sed -e "/^tag / s/seventh/7th forged/" raw >forged1 &&
  87         git hash-object -w -t tag forged1 >forged1.tag &&
  88         test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&
  89         grep "${GPGSSH_BAD_SIGNATURE}" actual1 &&
  90         ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual1 &&
  91         ! grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual1
  92 '
  93
  94 test_expect_success GPGSSH 'verify ssh signatures with --raw' '
  95         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
  96         (
  97                 for tag in initial second merge fourth-signed sixth-signed seventh-signed
  98                 do
  99                         git verify-tag --raw $tag 2>actual &&
 100                         grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
 101                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
 102                         echo $tag OK || exit 1
 103                 done
 104         ) &&
 105         (
 106                 for tag in fourth-unsigned fifth-unsigned sixth-unsigned
 107                 do
 108                         test_must_fail git verify-tag --raw $tag 2>actual &&
 109                         ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
 110                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
 111                         echo $tag OK || exit 1
 112                 done
 113         ) &&
 114         (
 115                 for tag in eighth-signed-alt
 116                 do
 117                         test_must_fail git verify-tag --raw $tag 2>actual &&
 118                         grep "${GPGSSH_GOOD_SIGNATURE_UNTRUSTED}" actual &&
 119                         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
 120                         echo $tag OK || exit 1
 121                 done
 122         )
 123 '
 124
 125 test_expect_success GPGSSH 'verify signatures with --raw ssh' '
 126         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
 127         git verify-tag --raw sixth-signed 2>actual &&
 128         grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
 129         ! grep "${GPGSSH_BAD_SIGNATURE}" actual &&
 130         echo sixth-signed OK
 131 '
 132
 133 test_expect_success GPGSSH 'verify multiple tags ssh' '
 134         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
 135         tags="seventh-signed sixth-signed" &&
 136         for i in $tags
 137         do
 138                 git verify-tag -v --raw $i || return 1
 139         done >expect.stdout 2>expect.stderr.1 &&
 140         grep "^${GPGSSH_GOOD_SIGNATURE_TRUSTED}" <expect.stderr.1 >expect.stderr &&
 141         git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
 142         grep "^${GPGSSH_GOOD_SIGNATURE_TRUSTED}" <actual.stderr.1 >actual.stderr &&
 143         test_cmp expect.stdout actual.stdout &&
 144         test_cmp expect.stderr actual.stderr
 145 '
 146
 147 test_expect_success GPGSSH 'verifying tag with --format - ssh' '
 148         test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
 149         cat >expect <<-\EOF &&
 150         tagname : fourth-signed
 151         EOF
 152         git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual &&
 153         test_cmp expect actual
 154 '
 155
 156 test_expect_success GPGSSH 'verifying a forged tag with --format should fail silently - ssh' '
 157         test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged &&
 158         test_must_be_empty actual-forged
 159 '
 160
 161 test_done