[thirdparty/git.git] / gpg-interface.c

#include "cache.h"
#include "config.h"
#include "run-command.h"
#include "strbuf.h"
#include "gpg-interface.h"
#include "sigchain.h"
#include "tempfile.h"

static char *configured_signing_key;
struct gpg_format {
	const char *name;
	const char *program;
	const char **verify_args;
	const char **sigs;
};

static const char *openpgp_verify_args[] = {
	"--keyid-format=long",
	NULL
};
static const char *openpgp_sigs[] = {
	"-----BEGIN PGP SIGNATURE-----",
	"-----BEGIN PGP MESSAGE-----",
	NULL
};

static struct gpg_format gpg_format[] = {
	{ .name = "openpgp", .program = "gpg",
	  .verify_args = openpgp_verify_args,
	  .sigs = openpgp_sigs
	},
};

static struct gpg_format *use_format = &gpg_format[0];

static struct gpg_format *get_format_by_name(const char *str)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		if (!strcmp(gpg_format[i].name, str))
			return gpg_format + i;
	return NULL;
}

static struct gpg_format *get_format_by_sig(const char *sig)
{
	int i, j;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		for (j = 0; gpg_format[i].sigs[j]; j++)
			if (starts_with(sig, gpg_format[i].sigs[j]))
				return gpg_format + i;
	return NULL;
}

void signature_check_clear(struct signature_check *sigc)
{
	FREE_AND_NULL(sigc->payload);
	FREE_AND_NULL(sigc->gpg_output);
	FREE_AND_NULL(sigc->gpg_status);
	FREE_AND_NULL(sigc->signer);
	FREE_AND_NULL(sigc->key);
}

static struct {
	char result;
	const char *check;
} sigcheck_gpg_status[] = {
	{ 'G', "\n[GNUPG:] GOODSIG " },
	{ 'B', "\n[GNUPG:] BADSIG " },
	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
	{ 'E', "\n[GNUPG:] ERRSIG "},
	{ 'X', "\n[GNUPG:] EXPSIG "},
	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	{ 'R', "\n[GNUPG:] REVKEYSIG "},
};

static void parse_gpg_output(struct signature_check *sigc)
{
	const char *buf = sigc->gpg_status;
	int i;

	/* Iterate over all search strings */
	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
		const char *found, *next;

		if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
			found = strstr(buf, sigcheck_gpg_status[i].check);
			if (!found)
				continue;
			found += strlen(sigcheck_gpg_status[i].check);
		}
		sigc->result = sigcheck_gpg_status[i].result;
		/* The trust messages are not followed by key/signer information */
		if (sigc->result != 'U') {
			sigc->key = xmemdupz(found, 16);
			/* The ERRSIG message is not followed by signer information */
			if (sigc-> result != 'E') {
				found += 17;
				next = strchrnul(found, '\n');
				sigc->signer = xmemdupz(found, next - found);
			}
		}
	}
}

int check_signature(const char *payload, size_t plen, const char *signature,
	size_t slen, struct signature_check *sigc)
{
	struct strbuf gpg_output = STRBUF_INIT;
	struct strbuf gpg_status = STRBUF_INIT;
	int status;

	sigc->result = 'N';

	status = verify_signed_buffer(payload, plen, signature, slen,
				      &gpg_output, &gpg_status);
	if (status && !gpg_output.len)
		goto out;
	sigc->payload = xmemdupz(payload, plen);
	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	parse_gpg_output(sigc);

 out:
	strbuf_release(&gpg_status);
	strbuf_release(&gpg_output);

	return sigc->result != 'G' && sigc->result != 'U';
}

void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
{
	const char *output = flags & GPG_VERIFY_RAW ?
		sigc->gpg_status : sigc->gpg_output;

	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
		fputs(sigc->payload, stdout);

	if (output)
		fputs(output, stderr);
}

size_t parse_signature(const char *buf, size_t size)
{
	size_t len = 0;
	size_t match = size;
	while (len < size) {
		const char *eol;

		if (get_format_by_sig(buf + len))
			match = len;

		eol = memchr(buf + len, '\n', size - len);
		len += eol ? eol - (buf + len) + 1 : size - len;
	}
	return match;
}

void set_signing_key(const char *key)
{
	free(configured_signing_key);
	configured_signing_key = xstrdup(key);
}

int git_gpg_config(const char *var, const char *value, void *cb)
{
	struct gpg_format *fmt = NULL;
	char *fmtname = NULL;

	if (!strcmp(var, "user.signingkey")) {
		if (!value)
			return config_error_nonbool(var);
		set_signing_key(value);
		return 0;
	}

	if (!strcmp(var, "gpg.format")) {
		if (!value)
			return config_error_nonbool(var);
		fmt = get_format_by_name(value);
		if (!fmt)
			return error("unsupported value for %s: %s",
				     var, value);
		use_format = fmt;
		return 0;
	}

	if (!strcmp(var, "gpg.program"))
		fmtname = "openpgp";

	if (fmtname) {
		fmt = get_format_by_name(fmtname);
		return git_config_string(&fmt->program, var, value);
	}

	return 0;
}

const char *get_signing_key(void)
{
	if (configured_signing_key)
		return configured_signing_key;
	return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
}

int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	int ret;
	size_t i, j, bottom;
	struct strbuf gpg_status = STRBUF_INIT;

	argv_array_pushl(&gpg.args,
			 use_format->program,
			 "--status-fd=2",
			 "-bsau", signing_key,
			 NULL);

	bottom = signature->len;

	/*
	 * When the username signingkey is bad, program could be terminated
	 * because gpg exits without reading and then write gets SIGPIPE.
	 */
	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, buffer->buf, buffer->len,
			   signature, 1024, &gpg_status, 0);
	sigchain_pop(SIGPIPE);

	ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	strbuf_release(&gpg_status);
	if (ret)
		return error(_("gpg failed to sign the data"));

	/* Strip CR from the line endings, in case we are on Windows. */
	for (i = j = bottom; i < signature->len; i++)
		if (signature->buf[i] != '\r') {
			if (i != j)
				signature->buf[j] = signature->buf[i];
			j++;
		}
	strbuf_setlen(signature, j);

	return 0;
}

int verify_signed_buffer(const char *payload, size_t payload_size,
			 const char *signature, size_t signature_size,
			 struct strbuf *gpg_output, struct strbuf *gpg_status)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	struct gpg_format *fmt;
	struct tempfile *temp;
	int ret;
	struct strbuf buf = STRBUF_INIT;

	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
	if (!temp)
		return error_errno(_("could not create temporary file"));
	if (write_in_full(temp->fd, signature, signature_size) < 0 ||
	    close_tempfile_gently(temp) < 0) {
		error_errno(_("failed writing detached signature to '%s'"),
			    temp->filename.buf);
		delete_tempfile(&temp);
		return -1;
	}

	fmt = get_format_by_sig(signature);
	if (!fmt)
		BUG("bad signature '%s'", signature);

	argv_array_push(&gpg.args, fmt->program);
	argv_array_pushv(&gpg.args, fmt->verify_args);
	argv_array_pushl(&gpg.args,
			 "--status-fd=1",
			 "--verify", temp->filename.buf, "-",
			 NULL);

	if (!gpg_status)
		gpg_status = &buf;

	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, payload, payload_size,
			   gpg_status, 0, gpg_output, 0);
	sigchain_pop(SIGPIPE);

	delete_tempfile(&temp);

	ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
	strbuf_release(&buf); /* no matter it was used or not */

	return ret;
}
Commit	Line	Data
2f47eae2	1	#include "cache.h"
b2141fc1	2	#include "config.h"
2f47eae2 JH	3	#include "run-command.h"
	4	#include "strbuf.h"
	5	#include "gpg-interface.h"
	6	#include "sigchain.h"
4322353b	7	#include "tempfile.h"
2f47eae2 JH	8
2f47eae2 JH	9	static char *configured_signing_key;
58af57e1 HS	10	struct gpg_format {
	11	const char *name;
	12	const char *program;
	13	const char **verify_args;
	14	const char **sigs;
	15	};
	16
	17	static const char *openpgp_verify_args[] = {
	18	"--keyid-format=long",
	19	NULL
	20	};
	21	static const char *openpgp_sigs[] = {
	22	"-----BEGIN PGP SIGNATURE-----",
	23	"-----BEGIN PGP MESSAGE-----",
	24	NULL
	25	};
	26
	27	static struct gpg_format gpg_format[] = {
	28	{ .name = "openpgp", .program = "gpg",
	29	.verify_args = openpgp_verify_args,
	30	.sigs = openpgp_sigs
	31	},
	32	};
	33
	34	static struct gpg_format *use_format = &gpg_format[0];
2f47eae2	35
58af57e1 HS	36	static struct gpg_format get_format_by_name(const char str)
	37	{
	38	int i;
	39
	40	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	41	if (!strcmp(gpg_format[i].name, str))
	42	return gpg_format + i;
	43	return NULL;
	44	}
	45
	46	static struct gpg_format get_format_by_sig(const char sig)
	47	{
	48	int i, j;
	49
	50	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	51	for (j = 0; gpg_format[i].sigs[j]; j++)
	52	if (starts_with(sig, gpg_format[i].sigs[j]))
	53	return gpg_format + i;
	54	return NULL;
	55	}
d7c67668	56
01e57b5d MG	57	void signature_check_clear(struct signature_check *sigc)
01e57b5d MG	58	{
88ce3ef6 ÆAB	59	FREE_AND_NULL(sigc->payload);
	60	FREE_AND_NULL(sigc->gpg_output);
	61	FREE_AND_NULL(sigc->gpg_status);
	62	FREE_AND_NULL(sigc->signer);
	63	FREE_AND_NULL(sigc->key);
01e57b5d MG	64	}
01e57b5d MG	65
a50e7ca3 JH	66	static struct {
	67	char result;
	68	const char *check;
	69	} sigcheck_gpg_status[] = {
	70	{ 'G', "\n[GNUPG:] GOODSIG " },
	71	{ 'B', "\n[GNUPG:] BADSIG " },
	72	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	73	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
661a1806 MG	74	{ 'E', "\n[GNUPG:] ERRSIG "},
	75	{ 'X', "\n[GNUPG:] EXPSIG "},
	76	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	77	{ 'R', "\n[GNUPG:] REVKEYSIG "},
a50e7ca3 JH	78	};
a50e7ca3 JH	79
fbd0f166	80	static void parse_gpg_output(struct signature_check *sigc)
a50e7ca3 JH	81	{
	82	const char *buf = sigc->gpg_status;
	83	int i;
	84
	85	/* Iterate over all search strings */
	86	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
	87	const char found, next;
	88
	89	if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
	90	found = strstr(buf, sigcheck_gpg_status[i].check);
	91	if (!found)
	92	continue;
	93	found += strlen(sigcheck_gpg_status[i].check);
	94	}
	95	sigc->result = sigcheck_gpg_status[i].result;
	96	/* The trust messages are not followed by key/signer information */
	97	if (sigc->result != 'U') {
	98	sigc->key = xmemdupz(found, 16);
661a1806 MG	99	/* The ERRSIG message is not followed by signer information */
	100	if (sigc-> result != 'E') {
	101	found += 17;
	102	next = strchrnul(found, '\n');
	103	sigc->signer = xmemdupz(found, next - found);
	104	}
a50e7ca3 JH	105	}
	106	}
	107	}
	108
434060ec	109	int check_signature(const char payload, size_t plen, const char signature,
a4cc18f2	110	size_t slen, struct signature_check *sigc)
	111	{
	112	struct strbuf gpg_output = STRBUF_INIT;
	113	struct strbuf gpg_status = STRBUF_INIT;
	114	int status;
	115
	116	sigc->result = 'N';
	117
	118	status = verify_signed_buffer(payload, plen, signature, slen,
	119	&gpg_output, &gpg_status);
	120	if (status && !gpg_output.len)
	121	goto out;
	122	sigc->payload = xmemdupz(payload, plen);
	123	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	124	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	125	parse_gpg_output(sigc);
	126
	127	out:
	128	strbuf_release(&gpg_status);
	129	strbuf_release(&gpg_output);
434060ec	130
434060ec	131	return sigc->result != 'G' && sigc->result != 'U';
a4cc18f2	132	}
a4cc18f2	133
ca194d50	134	void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
ca194d50	135	{
aeff29dd	136	const char *output = flags & GPG_VERIFY_RAW ?
	137	sigc->gpg_status : sigc->gpg_output;
	138
ca194d50	139	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
	140	fputs(sigc->payload, stdout);
	141
aeff29dd	142	if (output)
aeff29dd	143	fputs(output, stderr);
ca194d50	144	}
ca194d50	145
e6fa6cde	146	size_t parse_signature(const char *buf, size_t size)
d7c67668	147	{
d7c67668	148	size_t len = 0;
8b44b2be JK	149	size_t match = size;
	150	while (len < size) {
	151	const char *eol;
	152
58af57e1	153	if (get_format_by_sig(buf + len))
8b44b2be JK	154	match = len;
	155
	156	eol = memchr(buf + len, '\n', size - len);
d7c67668 JH	157	len += eol ? eol - (buf + len) + 1 : size - len;
d7c67668 JH	158	}
8b44b2be	159	return match;
d7c67668 JH	160	}
d7c67668 JH	161
2f47eae2 JH	162	void set_signing_key(const char *key)
	163	{
	164	free(configured_signing_key);
	165	configured_signing_key = xstrdup(key);
	166	}
	167
	168	int git_gpg_config(const char var, const char value, void *cb)
	169	{
58af57e1 HS	170	struct gpg_format *fmt = NULL;
	171	char *fmtname = NULL;
	172
2f47eae2	173	if (!strcmp(var, "user.signingkey")) {
1b0eeec3 JK	174	if (!value)
1b0eeec3 JK	175	return config_error_nonbool(var);
0c5e70f0	176	set_signing_key(value);
1b0eeec3	177	return 0;
0c5e70f0	178	}
1b0eeec3	179
57a8dd75 HS	180	if (!strcmp(var, "gpg.format")) {
	181	if (!value)
	182	return config_error_nonbool(var);
58af57e1 HS	183	fmt = get_format_by_name(value);
58af57e1 HS	184	if (!fmt)
57a8dd75 HS	185	return error("unsupported value for %s: %s",
57a8dd75 HS	186	var, value);
58af57e1 HS	187	use_format = fmt;
58af57e1 HS	188	return 0;
57a8dd75 HS	189	}
57a8dd75 HS	190
58af57e1 HS	191	if (!strcmp(var, "gpg.program"))
	192	fmtname = "openpgp";
	193
	194	if (fmtname) {
	195	fmt = get_format_by_name(fmtname);
	196	return git_config_string(&fmt->program, var, value);
2f47eae2	197	}
1b0eeec3	198
2f47eae2 JH	199	return 0;
	200	}
	201
	202	const char *get_signing_key(void)
	203	{
	204	if (configured_signing_key)
	205	return configured_signing_key;
f9bc573f	206	return git_committer_info(IDENT_STRICT\|IDENT_NO_DATE);
2f47eae2 JH	207	}
2f47eae2 JH	208
2f47eae2 JH	209	int sign_buffer(struct strbuf buffer, struct strbuf signature, const char *signing_key)
2f47eae2 JH	210	{
d3180279	211	struct child_process gpg = CHILD_PROCESS_INIT;
0581b546	212	int ret;
2f47eae2	213	size_t i, j, bottom;
efee9553	214	struct strbuf gpg_status = STRBUF_INIT;
2f47eae2	215
aedb5dc3	216	argv_array_pushl(&gpg.args,
58af57e1	217	use_format->program,
efee9553	218	"--status-fd=2",
aedb5dc3 JK	219	"-bsau", signing_key,
aedb5dc3 JK	220	NULL);
2f47eae2	221
0581b546	222	bottom = signature->len;
2f47eae2 JH	223
	224	/*
	225	* When the username signingkey is bad, program could be terminated
	226	* because gpg exits without reading and then write gets SIGPIPE.
	227	*/
	228	sigchain_push(SIGPIPE, SIG_IGN);
0581b546	229	ret = pipe_command(&gpg, buffer->buf, buffer->len,
efee9553	230	signature, 1024, &gpg_status, 0);
2f47eae2 JH	231	sigchain_pop(SIGPIPE);
2f47eae2 JH	232
efee9553 MG	233	ret \|= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	234	strbuf_release(&gpg_status);
	235	if (ret)
2f47eae2 JH	236	return error(_("gpg failed to sign the data"));
	237
	238	/* Strip CR from the line endings, in case we are on Windows. */
	239	for (i = j = bottom; i < signature->len; i++)
	240	if (signature->buf[i] != '\r') {
	241	if (i != j)
	242	signature->buf[j] = signature->buf[i];
	243	j++;
	244	}
	245	strbuf_setlen(signature, j);
	246
	247	return 0;
	248	}
	249
2f47eae2 JH	250	int verify_signed_buffer(const char *payload, size_t payload_size,
2f47eae2 JH	251	const char *signature, size_t signature_size,
9cc4ac8f	252	struct strbuf gpg_output, struct strbuf gpg_status)
2f47eae2	253	{
d3180279	254	struct child_process gpg = CHILD_PROCESS_INIT;
58af57e1	255	struct gpg_format *fmt;
076aa2cb JK	256	struct tempfile *temp;
076aa2cb JK	257	int ret;
b60b7566	258	struct strbuf buf = STRBUF_INIT;
2f47eae2	259
076aa2cb JK	260	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
076aa2cb JK	261	if (!temp)
4322353b	262	return error_errno(_("could not create temporary file"));
076aa2cb JK	263	if (write_in_full(temp->fd, signature, signature_size) < 0 \|\|
076aa2cb JK	264	close_tempfile_gently(temp) < 0) {
4322353b	265	error_errno(_("failed writing detached signature to '%s'"),
076aa2cb	266	temp->filename.buf);
4322353b JK	267	delete_tempfile(&temp);
	268	return -1;
	269	}
2f47eae2	270
58af57e1 HS	271	fmt = get_format_by_sig(signature);
	272	if (!fmt)
	273	BUG("bad signature '%s'", signature);
	274
	275	argv_array_push(&gpg.args, fmt->program);
	276	argv_array_pushv(&gpg.args, fmt->verify_args);
aedb5dc3	277	argv_array_pushl(&gpg.args,
aedb5dc3	278	"--status-fd=1",
076aa2cb	279	"--verify", temp->filename.buf, "-",
aedb5dc3	280	NULL);
2f47eae2	281
c752fcc8 JK	282	if (!gpg_status)
c752fcc8 JK	283	gpg_status = &buf;
b60b7566	284
0d2b664e JK	285	sigchain_push(SIGPIPE, SIG_IGN);
	286	ret = pipe_command(&gpg, payload, payload_size,
	287	gpg_status, 0, gpg_output, 0);
d281b45d	288	sigchain_pop(SIGPIPE);
2f47eae2	289
4322353b	290	delete_tempfile(&temp);
2f47eae2	291
c752fcc8	292	ret \|= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
9cc4ac8f	293	strbuf_release(&buf); /* no matter it was used or not */
b60b7566	294
2f47eae2 JH	295	return ret;
2f47eae2 JH	296	}