[thirdparty/git.git] / gpg-interface.c

#include "cache.h"
#include "config.h"
#include "run-command.h"
#include "strbuf.h"
#include "gpg-interface.h"
#include "sigchain.h"
#include "tempfile.h"

static char *configured_signing_key;
struct gpg_format {
	const char *name;
	const char *program;
	const char **verify_args;
	const char **sigs;
};

static const char *openpgp_verify_args[] = {
	"--keyid-format=long",
	NULL
};
static const char *openpgp_sigs[] = {
	"-----BEGIN PGP SIGNATURE-----",
	"-----BEGIN PGP MESSAGE-----",
	NULL
};

static const char *x509_verify_args[] = {
	NULL
};
static const char *x509_sigs[] = {
	"-----BEGIN SIGNED MESSAGE-----",
	NULL
};

static struct gpg_format gpg_format[] = {
	{ .name = "openpgp", .program = "gpg",
	  .verify_args = openpgp_verify_args,
	  .sigs = openpgp_sigs
	},
	{ .name = "x509", .program = "gpgsm",
	  .verify_args = x509_verify_args,
	  .sigs = x509_sigs
	},
};

static struct gpg_format *use_format = &gpg_format[0];

static struct gpg_format *get_format_by_name(const char *str)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		if (!strcmp(gpg_format[i].name, str))
			return gpg_format + i;
	return NULL;
}

static struct gpg_format *get_format_by_sig(const char *sig)
{
	int i, j;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		for (j = 0; gpg_format[i].sigs[j]; j++)
			if (starts_with(sig, gpg_format[i].sigs[j]))
				return gpg_format + i;
	return NULL;
}

void signature_check_clear(struct signature_check *sigc)
{
	FREE_AND_NULL(sigc->payload);
	FREE_AND_NULL(sigc->gpg_output);
	FREE_AND_NULL(sigc->gpg_status);
	FREE_AND_NULL(sigc->signer);
	FREE_AND_NULL(sigc->key);
}

static struct {
	char result;
	const char *check;
} sigcheck_gpg_status[] = {
	{ 'G', "\n[GNUPG:] GOODSIG " },
	{ 'B', "\n[GNUPG:] BADSIG " },
	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
	{ 'E', "\n[GNUPG:] ERRSIG "},
	{ 'X', "\n[GNUPG:] EXPSIG "},
	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	{ 'R', "\n[GNUPG:] REVKEYSIG "},
};

static void parse_gpg_output(struct signature_check *sigc)
{
	const char *buf = sigc->gpg_status;
	int i;

	/* Iterate over all search strings */
	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
		const char *found, *next;

		if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
			found = strstr(buf, sigcheck_gpg_status[i].check);
			if (!found)
				continue;
			found += strlen(sigcheck_gpg_status[i].check);
		}
		sigc->result = sigcheck_gpg_status[i].result;
		/* The trust messages are not followed by key/signer information */
		if (sigc->result != 'U') {
			next = strchrnul(found, ' ');
			sigc->key = xmemdupz(found, next - found);
			/* The ERRSIG message is not followed by signer information */
			if (*next && sigc-> result != 'E') {
				found = next + 1;
				next = strchrnul(found, '\n');
				sigc->signer = xmemdupz(found, next - found);
			}
		}
	}
}

int check_signature(const char *payload, size_t plen, const char *signature,
	size_t slen, struct signature_check *sigc)
{
	struct strbuf gpg_output = STRBUF_INIT;
	struct strbuf gpg_status = STRBUF_INIT;
	int status;

	sigc->result = 'N';

	status = verify_signed_buffer(payload, plen, signature, slen,
				      &gpg_output, &gpg_status);
	if (status && !gpg_output.len)
		goto out;
	sigc->payload = xmemdupz(payload, plen);
	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	parse_gpg_output(sigc);

 out:
	strbuf_release(&gpg_status);
	strbuf_release(&gpg_output);

	return sigc->result != 'G' && sigc->result != 'U';
}

void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
{
	const char *output = flags & GPG_VERIFY_RAW ?
		sigc->gpg_status : sigc->gpg_output;

	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
		fputs(sigc->payload, stdout);

	if (output)
		fputs(output, stderr);
}

size_t parse_signature(const char *buf, size_t size)
{
	size_t len = 0;
	size_t match = size;
	while (len < size) {
		const char *eol;

		if (get_format_by_sig(buf + len))
			match = len;

		eol = memchr(buf + len, '\n', size - len);
		len += eol ? eol - (buf + len) + 1 : size - len;
	}
	return match;
}

void set_signing_key(const char *key)
{
	free(configured_signing_key);
	configured_signing_key = xstrdup(key);
}

int git_gpg_config(const char *var, const char *value, void *cb)
{
	struct gpg_format *fmt = NULL;
	char *fmtname = NULL;

	if (!strcmp(var, "user.signingkey")) {
		if (!value)
			return config_error_nonbool(var);
		set_signing_key(value);
		return 0;
	}

	if (!strcmp(var, "gpg.format")) {
		if (!value)
			return config_error_nonbool(var);
		fmt = get_format_by_name(value);
		if (!fmt)
			return error("unsupported value for %s: %s",
				     var, value);
		use_format = fmt;
		return 0;
	}

	if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
		fmtname = "openpgp";

	if (!strcmp(var, "gpg.x509.program"))
		fmtname = "x509";

	if (fmtname) {
		fmt = get_format_by_name(fmtname);
		return git_config_string(&fmt->program, var, value);
	}

	return 0;
}

const char *get_signing_key(void)
{
	if (configured_signing_key)
		return configured_signing_key;
	return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
}

int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	int ret;
	size_t i, j, bottom;
	struct strbuf gpg_status = STRBUF_INIT;

	argv_array_pushl(&gpg.args,
			 use_format->program,
			 "--status-fd=2",
			 "-bsau", signing_key,
			 NULL);

	bottom = signature->len;

	/*
	 * When the username signingkey is bad, program could be terminated
	 * because gpg exits without reading and then write gets SIGPIPE.
	 */
	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, buffer->buf, buffer->len,
			   signature, 1024, &gpg_status, 0);
	sigchain_pop(SIGPIPE);

	ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	strbuf_release(&gpg_status);
	if (ret)
		return error(_("gpg failed to sign the data"));

	/* Strip CR from the line endings, in case we are on Windows. */
	for (i = j = bottom; i < signature->len; i++)
		if (signature->buf[i] != '\r') {
			if (i != j)
				signature->buf[j] = signature->buf[i];
			j++;
		}
	strbuf_setlen(signature, j);

	return 0;
}

int verify_signed_buffer(const char *payload, size_t payload_size,
			 const char *signature, size_t signature_size,
			 struct strbuf *gpg_output, struct strbuf *gpg_status)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	struct gpg_format *fmt;
	struct tempfile *temp;
	int ret;
	struct strbuf buf = STRBUF_INIT;

	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
	if (!temp)
		return error_errno(_("could not create temporary file"));
	if (write_in_full(temp->fd, signature, signature_size) < 0 ||
	    close_tempfile_gently(temp) < 0) {
		error_errno(_("failed writing detached signature to '%s'"),
			    temp->filename.buf);
		delete_tempfile(&temp);
		return -1;
	}

	fmt = get_format_by_sig(signature);
	if (!fmt)
		BUG("bad signature '%s'", signature);

	argv_array_push(&gpg.args, fmt->program);
	argv_array_pushv(&gpg.args, fmt->verify_args);
	argv_array_pushl(&gpg.args,
			 "--status-fd=1",
			 "--verify", temp->filename.buf, "-",
			 NULL);

	if (!gpg_status)
		gpg_status = &buf;

	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, payload, payload_size,
			   gpg_status, 0, gpg_output, 0);
	sigchain_pop(SIGPIPE);

	delete_tempfile(&temp);

	ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
	strbuf_release(&buf); /* no matter it was used or not */

	return ret;
}
Commit	Line	Data
2f47eae2	1	#include "cache.h"
b2141fc1	2	#include "config.h"
2f47eae2 JH	3	#include "run-command.h"
	4	#include "strbuf.h"
	5	#include "gpg-interface.h"
	6	#include "sigchain.h"
4322353b	7	#include "tempfile.h"
2f47eae2 JH	8
2f47eae2 JH	9	static char *configured_signing_key;
58af57e1 HS	10	struct gpg_format {
	11	const char *name;
	12	const char *program;
	13	const char **verify_args;
	14	const char **sigs;
	15	};
	16
	17	static const char *openpgp_verify_args[] = {
	18	"--keyid-format=long",
	19	NULL
	20	};
	21	static const char *openpgp_sigs[] = {
	22	"-----BEGIN PGP SIGNATURE-----",
	23	"-----BEGIN PGP MESSAGE-----",
	24	NULL
	25	};
	26
1e7adb97 HS	27	static const char *x509_verify_args[] = {
	28	NULL
	29	};
	30	static const char *x509_sigs[] = {
	31	"-----BEGIN SIGNED MESSAGE-----",
	32	NULL
	33	};
	34
58af57e1 HS	35	static struct gpg_format gpg_format[] = {
	36	{ .name = "openpgp", .program = "gpg",
	37	.verify_args = openpgp_verify_args,
	38	.sigs = openpgp_sigs
	39	},
1e7adb97 HS	40	{ .name = "x509", .program = "gpgsm",
	41	.verify_args = x509_verify_args,
	42	.sigs = x509_sigs
	43	},
58af57e1 HS	44	};
	45
	46	static struct gpg_format *use_format = &gpg_format[0];
2f47eae2	47
58af57e1 HS	48	static struct gpg_format get_format_by_name(const char str)
	49	{
	50	int i;
	51
	52	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	53	if (!strcmp(gpg_format[i].name, str))
	54	return gpg_format + i;
	55	return NULL;
	56	}
	57
	58	static struct gpg_format get_format_by_sig(const char sig)
	59	{
	60	int i, j;
	61
	62	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	63	for (j = 0; gpg_format[i].sigs[j]; j++)
	64	if (starts_with(sig, gpg_format[i].sigs[j]))
	65	return gpg_format + i;
	66	return NULL;
	67	}
d7c67668	68
01e57b5d MG	69	void signature_check_clear(struct signature_check *sigc)
01e57b5d MG	70	{
88ce3ef6 ÆAB	71	FREE_AND_NULL(sigc->payload);
	72	FREE_AND_NULL(sigc->gpg_output);
	73	FREE_AND_NULL(sigc->gpg_status);
	74	FREE_AND_NULL(sigc->signer);
	75	FREE_AND_NULL(sigc->key);
01e57b5d MG	76	}
01e57b5d MG	77
a50e7ca3 JH	78	static struct {
	79	char result;
	80	const char *check;
	81	} sigcheck_gpg_status[] = {
	82	{ 'G', "\n[GNUPG:] GOODSIG " },
	83	{ 'B', "\n[GNUPG:] BADSIG " },
	84	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	85	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
661a1806 MG	86	{ 'E', "\n[GNUPG:] ERRSIG "},
	87	{ 'X', "\n[GNUPG:] EXPSIG "},
	88	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	89	{ 'R', "\n[GNUPG:] REVKEYSIG "},
a50e7ca3 JH	90	};
a50e7ca3 JH	91
fbd0f166	92	static void parse_gpg_output(struct signature_check *sigc)
a50e7ca3 JH	93	{
	94	const char *buf = sigc->gpg_status;
	95	int i;
	96
	97	/* Iterate over all search strings */
	98	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
	99	const char found, next;
	100
	101	if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
	102	found = strstr(buf, sigcheck_gpg_status[i].check);
	103	if (!found)
	104	continue;
	105	found += strlen(sigcheck_gpg_status[i].check);
	106	}
	107	sigc->result = sigcheck_gpg_status[i].result;
	108	/* The trust messages are not followed by key/signer information */
	109	if (sigc->result != 'U') {
42149d7f HS	110	next = strchrnul(found, ' ');
42149d7f HS	111	sigc->key = xmemdupz(found, next - found);
661a1806	112	/* The ERRSIG message is not followed by signer information */
42149d7f HS	113	if (*next && sigc-> result != 'E') {
42149d7f HS	114	found = next + 1;
661a1806 MG	115	next = strchrnul(found, '\n');
	116	sigc->signer = xmemdupz(found, next - found);
	117	}
a50e7ca3 JH	118	}
	119	}
	120	}
	121
434060ec	122	int check_signature(const char payload, size_t plen, const char signature,
a4cc18f2	123	size_t slen, struct signature_check *sigc)
	124	{
	125	struct strbuf gpg_output = STRBUF_INIT;
	126	struct strbuf gpg_status = STRBUF_INIT;
	127	int status;
	128
	129	sigc->result = 'N';
	130
	131	status = verify_signed_buffer(payload, plen, signature, slen,
	132	&gpg_output, &gpg_status);
	133	if (status && !gpg_output.len)
	134	goto out;
	135	sigc->payload = xmemdupz(payload, plen);
	136	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	137	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	138	parse_gpg_output(sigc);
	139
	140	out:
	141	strbuf_release(&gpg_status);
	142	strbuf_release(&gpg_output);
434060ec	143
434060ec	144	return sigc->result != 'G' && sigc->result != 'U';
a4cc18f2	145	}
a4cc18f2	146
ca194d50	147	void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
ca194d50	148	{
aeff29dd	149	const char *output = flags & GPG_VERIFY_RAW ?
	150	sigc->gpg_status : sigc->gpg_output;
	151
ca194d50	152	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
	153	fputs(sigc->payload, stdout);
	154
aeff29dd	155	if (output)
aeff29dd	156	fputs(output, stderr);
ca194d50	157	}
ca194d50	158
e6fa6cde	159	size_t parse_signature(const char *buf, size_t size)
d7c67668	160	{
d7c67668	161	size_t len = 0;
8b44b2be JK	162	size_t match = size;
	163	while (len < size) {
	164	const char *eol;
	165
58af57e1	166	if (get_format_by_sig(buf + len))
8b44b2be JK	167	match = len;
	168
	169	eol = memchr(buf + len, '\n', size - len);
d7c67668 JH	170	len += eol ? eol - (buf + len) + 1 : size - len;
d7c67668 JH	171	}
8b44b2be	172	return match;
d7c67668 JH	173	}
d7c67668 JH	174
2f47eae2 JH	175	void set_signing_key(const char *key)
	176	{
	177	free(configured_signing_key);
	178	configured_signing_key = xstrdup(key);
	179	}
	180
	181	int git_gpg_config(const char var, const char value, void *cb)
	182	{
58af57e1 HS	183	struct gpg_format *fmt = NULL;
	184	char *fmtname = NULL;
	185
2f47eae2	186	if (!strcmp(var, "user.signingkey")) {
1b0eeec3 JK	187	if (!value)
1b0eeec3 JK	188	return config_error_nonbool(var);
0c5e70f0	189	set_signing_key(value);
1b0eeec3	190	return 0;
0c5e70f0	191	}
1b0eeec3	192
57a8dd75 HS	193	if (!strcmp(var, "gpg.format")) {
	194	if (!value)
	195	return config_error_nonbool(var);
58af57e1 HS	196	fmt = get_format_by_name(value);
58af57e1 HS	197	if (!fmt)
57a8dd75 HS	198	return error("unsupported value for %s: %s",
57a8dd75 HS	199	var, value);
58af57e1 HS	200	use_format = fmt;
58af57e1 HS	201	return 0;
57a8dd75 HS	202	}
57a8dd75 HS	203
b02f51b1	204	if (!strcmp(var, "gpg.program") \|\| !strcmp(var, "gpg.openpgp.program"))
58af57e1 HS	205	fmtname = "openpgp";
58af57e1 HS	206
1e7adb97 HS	207	if (!strcmp(var, "gpg.x509.program"))
	208	fmtname = "x509";
	209
58af57e1 HS	210	if (fmtname) {
	211	fmt = get_format_by_name(fmtname);
	212	return git_config_string(&fmt->program, var, value);
2f47eae2	213	}
1b0eeec3	214
2f47eae2 JH	215	return 0;
	216	}
	217
	218	const char *get_signing_key(void)
	219	{
	220	if (configured_signing_key)
	221	return configured_signing_key;
f9bc573f	222	return git_committer_info(IDENT_STRICT\|IDENT_NO_DATE);
2f47eae2 JH	223	}
2f47eae2 JH	224
2f47eae2 JH	225	int sign_buffer(struct strbuf buffer, struct strbuf signature, const char *signing_key)
2f47eae2 JH	226	{
d3180279	227	struct child_process gpg = CHILD_PROCESS_INIT;
0581b546	228	int ret;
2f47eae2	229	size_t i, j, bottom;
efee9553	230	struct strbuf gpg_status = STRBUF_INIT;
2f47eae2	231
aedb5dc3	232	argv_array_pushl(&gpg.args,
58af57e1	233	use_format->program,
efee9553	234	"--status-fd=2",
aedb5dc3 JK	235	"-bsau", signing_key,
aedb5dc3 JK	236	NULL);
2f47eae2	237
0581b546	238	bottom = signature->len;
2f47eae2 JH	239
	240	/*
	241	* When the username signingkey is bad, program could be terminated
	242	* because gpg exits without reading and then write gets SIGPIPE.
	243	*/
	244	sigchain_push(SIGPIPE, SIG_IGN);
0581b546	245	ret = pipe_command(&gpg, buffer->buf, buffer->len,
efee9553	246	signature, 1024, &gpg_status, 0);
2f47eae2 JH	247	sigchain_pop(SIGPIPE);
2f47eae2 JH	248
efee9553 MG	249	ret \|= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	250	strbuf_release(&gpg_status);
	251	if (ret)
2f47eae2 JH	252	return error(_("gpg failed to sign the data"));
	253
	254	/* Strip CR from the line endings, in case we are on Windows. */
	255	for (i = j = bottom; i < signature->len; i++)
	256	if (signature->buf[i] != '\r') {
	257	if (i != j)
	258	signature->buf[j] = signature->buf[i];
	259	j++;
	260	}
	261	strbuf_setlen(signature, j);
	262
	263	return 0;
	264	}
	265
2f47eae2 JH	266	int verify_signed_buffer(const char *payload, size_t payload_size,
2f47eae2 JH	267	const char *signature, size_t signature_size,
9cc4ac8f	268	struct strbuf gpg_output, struct strbuf gpg_status)
2f47eae2	269	{
d3180279	270	struct child_process gpg = CHILD_PROCESS_INIT;
58af57e1	271	struct gpg_format *fmt;
076aa2cb JK	272	struct tempfile *temp;
076aa2cb JK	273	int ret;
b60b7566	274	struct strbuf buf = STRBUF_INIT;
2f47eae2	275
076aa2cb JK	276	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
076aa2cb JK	277	if (!temp)
4322353b	278	return error_errno(_("could not create temporary file"));
076aa2cb JK	279	if (write_in_full(temp->fd, signature, signature_size) < 0 \|\|
076aa2cb JK	280	close_tempfile_gently(temp) < 0) {
4322353b	281	error_errno(_("failed writing detached signature to '%s'"),
076aa2cb	282	temp->filename.buf);
4322353b JK	283	delete_tempfile(&temp);
	284	return -1;
	285	}
2f47eae2	286
58af57e1 HS	287	fmt = get_format_by_sig(signature);
	288	if (!fmt)
	289	BUG("bad signature '%s'", signature);
	290
	291	argv_array_push(&gpg.args, fmt->program);
	292	argv_array_pushv(&gpg.args, fmt->verify_args);
aedb5dc3	293	argv_array_pushl(&gpg.args,
aedb5dc3	294	"--status-fd=1",
076aa2cb	295	"--verify", temp->filename.buf, "-",
aedb5dc3	296	NULL);
2f47eae2	297
c752fcc8 JK	298	if (!gpg_status)
c752fcc8 JK	299	gpg_status = &buf;
b60b7566	300
0d2b664e JK	301	sigchain_push(SIGPIPE, SIG_IGN);
	302	ret = pipe_command(&gpg, payload, payload_size,
	303	gpg_status, 0, gpg_output, 0);
d281b45d	304	sigchain_pop(SIGPIPE);
2f47eae2	305
4322353b	306	delete_tempfile(&temp);
2f47eae2	307
c752fcc8	308	ret \|= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
9cc4ac8f	309	strbuf_release(&buf); /* no matter it was used or not */
b60b7566	310
2f47eae2 JH	311	return ret;
2f47eae2 JH	312	}