]>
Commit | Line | Data |
---|---|---|
d66aeff2 | 1 | #!/bin/sh |
2 | ||
3 | test_description='signed tag tests' | |
01dc8133 | 4 | GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main |
334afbc7 JS |
5 | export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME |
6 | ||
d66aeff2 | 7 | . ./test-lib.sh |
8 | . "$TEST_DIRECTORY/lib-gpg.sh" | |
9 | ||
10 | test_expect_success GPG 'create signed tags' ' | |
11 | echo 1 >file && git add file && | |
12 | test_tick && git commit -m initial && | |
13 | git tag -s -m initial initial && | |
14 | git branch side && | |
15 | ||
16 | echo 2 >file && test_tick && git commit -a -m second && | |
17 | git tag -s -m second second && | |
18 | ||
19 | git checkout side && | |
20 | echo 3 >elif && git add elif && | |
21 | test_tick && git commit -m "third on side" && | |
22 | ||
01dc8133 | 23 | git checkout main && |
d66aeff2 | 24 | test_tick && git merge -S side && |
25 | git tag -s -m merge merge && | |
26 | ||
27 | echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" && | |
28 | git tag -a -m fourth-unsigned fourth-unsigned && | |
29 | ||
30 | test_tick && git commit --amend -S -m "fourth signed" && | |
31 | git tag -s -m fourth fourth-signed && | |
32 | ||
33 | echo 5 >file && test_tick && git commit -a -m "fifth" && | |
34 | git tag fifth-unsigned && | |
35 | ||
36 | git config commit.gpgsign true && | |
37 | echo 6 >file && test_tick && git commit -a -m "sixth" && | |
38 | git tag -a -m sixth sixth-unsigned && | |
39 | ||
40 | test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ && | |
41 | git tag -m seventh -s seventh-signed && | |
42 | ||
43 | echo 8 >file && test_tick && git commit -a -m eighth && | |
44 | git tag -uB7227189 -m eighth eighth-signed-alt | |
45 | ' | |
46 | ||
53fc9993 HS |
47 | test_expect_success GPGSM 'create signed tags x509 ' ' |
48 | test_config gpg.format x509 && | |
49 | test_config user.signingkey $GIT_COMMITTER_EMAIL && | |
aa74be31 EN |
50 | echo 9 >file && test_tick && git commit -a -m "ninth gpgsm-signed" && |
51 | git tag -s -m ninth ninth-signed-x509 | |
53fc9993 HS |
52 | ' |
53 | ||
d66aeff2 | 54 | test_expect_success GPG 'verify and show signatures' ' |
55 | ( | |
56 | for tag in initial second merge fourth-signed sixth-signed seventh-signed | |
57 | do | |
58 | git verify-tag $tag 2>actual && | |
59 | grep "Good signature from" actual && | |
60 | ! grep "BAD signature from" actual && | |
61 | echo $tag OK || exit 1 | |
62 | done | |
63 | ) && | |
64 | ( | |
65 | for tag in fourth-unsigned fifth-unsigned sixth-unsigned | |
66 | do | |
67 | test_must_fail git verify-tag $tag 2>actual && | |
68 | ! grep "Good signature from" actual && | |
69 | ! grep "BAD signature from" actual && | |
70 | echo $tag OK || exit 1 | |
71 | done | |
72 | ) && | |
73 | ( | |
74 | for tag in eighth-signed-alt | |
75 | do | |
76 | git verify-tag $tag 2>actual && | |
77 | grep "Good signature from" actual && | |
78 | ! grep "BAD signature from" actual && | |
79 | grep "not certified" actual && | |
80 | echo $tag OK || exit 1 | |
81 | done | |
82 | ) | |
83 | ' | |
84 | ||
53fc9993 | 85 | test_expect_success GPGSM 'verify and show signatures x509' ' |
aa74be31 | 86 | git verify-tag ninth-signed-x509 2>actual && |
53fc9993 HS |
87 | grep "Good signature from" actual && |
88 | ! grep "BAD signature from" actual && | |
aa74be31 | 89 | echo ninth-signed-x509 OK |
53fc9993 HS |
90 | ' |
91 | ||
54887b46 HJI |
92 | test_expect_success GPGSM 'verify and show signatures x509 with low minTrustLevel' ' |
93 | test_config gpg.minTrustLevel undefined && | |
94 | git verify-tag ninth-signed-x509 2>actual && | |
95 | grep "Good signature from" actual && | |
96 | ! grep "BAD signature from" actual && | |
97 | echo ninth-signed-x509 OK | |
98 | ' | |
99 | ||
100 | test_expect_success GPGSM 'verify and show signatures x509 with matching minTrustLevel' ' | |
101 | test_config gpg.minTrustLevel fully && | |
102 | git verify-tag ninth-signed-x509 2>actual && | |
103 | grep "Good signature from" actual && | |
104 | ! grep "BAD signature from" actual && | |
105 | echo ninth-signed-x509 OK | |
106 | ' | |
107 | ||
108 | test_expect_success GPGSM 'verify and show signatures x509 with high minTrustLevel' ' | |
109 | test_config gpg.minTrustLevel ultimate && | |
110 | test_must_fail git verify-tag ninth-signed-x509 2>actual && | |
111 | grep "Good signature from" actual && | |
112 | ! grep "BAD signature from" actual && | |
113 | echo ninth-signed-x509 OK | |
114 | ' | |
115 | ||
d66aeff2 | 116 | test_expect_success GPG 'detect fudged signature' ' |
117 | git cat-file tag seventh-signed >raw && | |
2f3cbcd8 | 118 | sed -e "/^tag / s/seventh/7th forged/" raw >forged1 && |
d66aeff2 | 119 | git hash-object -w -t tag forged1 >forged1.tag && |
120 | test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 && | |
121 | grep "BAD signature from" actual1 && | |
122 | ! grep "Good signature from" actual1 | |
123 | ' | |
124 | ||
e18443ec | 125 | test_expect_success GPG 'verify signatures with --raw' ' |
126 | ( | |
127 | for tag in initial second merge fourth-signed sixth-signed seventh-signed | |
128 | do | |
129 | git verify-tag --raw $tag 2>actual && | |
130 | grep "GOODSIG" actual && | |
131 | ! grep "BADSIG" actual && | |
132 | echo $tag OK || exit 1 | |
133 | done | |
134 | ) && | |
135 | ( | |
136 | for tag in fourth-unsigned fifth-unsigned sixth-unsigned | |
137 | do | |
138 | test_must_fail git verify-tag --raw $tag 2>actual && | |
139 | ! grep "GOODSIG" actual && | |
140 | ! grep "BADSIG" actual && | |
141 | echo $tag OK || exit 1 | |
142 | done | |
143 | ) && | |
144 | ( | |
145 | for tag in eighth-signed-alt | |
146 | do | |
147 | git verify-tag --raw $tag 2>actual && | |
148 | grep "GOODSIG" actual && | |
149 | ! grep "BADSIG" actual && | |
150 | grep "TRUST_UNDEFINED" actual && | |
151 | echo $tag OK || exit 1 | |
152 | done | |
153 | ) | |
154 | ' | |
155 | ||
53fc9993 | 156 | test_expect_success GPGSM 'verify signatures with --raw x509' ' |
aa74be31 | 157 | git verify-tag --raw ninth-signed-x509 2>actual && |
53fc9993 HS |
158 | grep "GOODSIG" actual && |
159 | ! grep "BADSIG" actual && | |
aa74be31 | 160 | echo ninth-signed-x509 OK |
53fc9993 HS |
161 | ' |
162 | ||
3e1e7454 ST |
163 | test_expect_success GPG 'verify multiple tags' ' |
164 | tags="fourth-signed sixth-signed seventh-signed" && | |
165 | for i in $tags | |
166 | do | |
167 | git verify-tag -v --raw $i || return 1 | |
168 | done >expect.stdout 2>expect.stderr.1 && | |
169 | grep "^.GNUPG:." <expect.stderr.1 >expect.stderr && | |
170 | git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 && | |
171 | grep "^.GNUPG:." <actual.stderr.1 >actual.stderr && | |
172 | test_cmp expect.stdout actual.stdout && | |
173 | test_cmp expect.stderr actual.stderr | |
174 | ' | |
175 | ||
53fc9993 | 176 | test_expect_success GPGSM 'verify multiple tags x509' ' |
aa74be31 | 177 | tags="seventh-signed ninth-signed-x509" && |
53fc9993 HS |
178 | for i in $tags |
179 | do | |
180 | git verify-tag -v --raw $i || return 1 | |
181 | done >expect.stdout 2>expect.stderr.1 && | |
182 | grep "^.GNUPG:." <expect.stderr.1 >expect.stderr && | |
183 | git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 && | |
184 | grep "^.GNUPG:." <actual.stderr.1 >actual.stderr && | |
185 | test_cmp expect.stdout actual.stdout && | |
186 | test_cmp expect.stderr actual.stderr | |
187 | ' | |
188 | ||
b42ca35e ST |
189 | test_expect_success GPG 'verifying tag with --format' ' |
190 | cat >expect <<-\EOF && | |
02c5433e | 191 | tagname : fourth-signed |
b42ca35e | 192 | EOF |
02c5433e ST |
193 | git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual && |
194 | test_cmp expect actual | |
195 | ' | |
196 | ||
b42ca35e | 197 | test_expect_success GPG 'verifying a forged tag with --format should fail silently' ' |
02c5433e | 198 | test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged && |
d3c6751b | 199 | test_must_be_empty actual-forged |
02c5433e ST |
200 | ' |
201 | ||
d66aeff2 | 202 | test_done |