]>
Commit | Line | Data |
---|---|---|
247503f2 JH |
1 | #!/bin/sh |
2 | ||
3 | test_description='signed commit tests' | |
4 | . ./test-lib.sh | |
661a1806 | 5 | GNUPGHOME_NOT_USED=$GNUPGHOME |
247503f2 JH |
6 | . "$TEST_DIRECTORY/lib-gpg.sh" |
7 | ||
8 | test_expect_success GPG 'create signed commits' ' | |
4b8d14b4 NV |
9 | test_when_finished "test_unconfig commit.gpgsign" && |
10 | ||
247503f2 JH |
11 | echo 1 >file && git add file && |
12 | test_tick && git commit -S -m initial && | |
13 | git tag initial && | |
14 | git branch side && | |
15 | ||
16 | echo 2 >file && test_tick && git commit -a -S -m second && | |
17 | git tag second && | |
18 | ||
19 | git checkout side && | |
20 | echo 3 >elif && git add elif && | |
21 | test_tick && git commit -m "third on side" && | |
22 | ||
23 | git checkout master && | |
24 | test_tick && git merge -S side && | |
25 | git tag merge && | |
26 | ||
27 | echo 4 >file && test_tick && git commit -a -m "fourth unsigned" && | |
28 | git tag fourth-unsigned && | |
29 | ||
c871a1d1 | 30 | test_tick && git commit --amend -S -m "fourth signed" && |
4b8d14b4 NV |
31 | git tag fourth-signed && |
32 | ||
33 | git config commit.gpgsign true && | |
34 | echo 5 >file && test_tick && git commit -a -m "fifth signed" && | |
35 | git tag fifth-signed && | |
36 | ||
37 | git config commit.gpgsign false && | |
38 | echo 6 >file && test_tick && git commit -a -m "sixth" && | |
39 | git tag sixth-unsigned && | |
40 | ||
41 | git config commit.gpgsign true && | |
42 | echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign && | |
43 | git tag seventh-unsigned && | |
44 | ||
45 | test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ && | |
99094a7a | 46 | git tag seventh-signed && |
4baf839f JK |
47 | |
48 | echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 && | |
66948561 JH |
49 | git tag eighth-signed-alt && |
50 | ||
51 | # commit.gpgsign is still on but this must not be signed | |
52 | git tag ninth-unsigned $(echo 9 | git commit-tree HEAD^{tree}) && | |
53 | # explicit -S of course must sign. | |
54 | git tag tenth-signed $(echo 9 | git commit-tree -S HEAD^{tree}) | |
247503f2 JH |
55 | ' |
56 | ||
8e92c2cf | 57 | test_expect_success GPG 'verify and show signatures' ' |
247503f2 | 58 | ( |
66948561 JH |
59 | for commit in initial second merge fourth-signed \ |
60 | fifth-signed sixth-signed seventh-signed tenth-signed | |
247503f2 | 61 | do |
8e92c2cf | 62 | git verify-commit $commit && |
247503f2 | 63 | git show --pretty=short --show-signature $commit >actual && |
7b1732c1 MG |
64 | grep "Good signature from" actual && |
65 | ! grep "BAD signature from" actual && | |
66 | echo $commit OK || exit 1 | |
247503f2 JH |
67 | done |
68 | ) && | |
69 | ( | |
66948561 JH |
70 | for commit in merge^2 fourth-unsigned sixth-unsigned \ |
71 | seventh-unsigned ninth-unsigned | |
247503f2 | 72 | do |
8e92c2cf | 73 | test_must_fail git verify-commit $commit && |
247503f2 | 74 | git show --pretty=short --show-signature $commit >actual && |
7b1732c1 MG |
75 | ! grep "Good signature from" actual && |
76 | ! grep "BAD signature from" actual && | |
77 | echo $commit OK || exit 1 | |
4baf839f JK |
78 | done |
79 | ) && | |
80 | ( | |
81 | for commit in eighth-signed-alt | |
82 | do | |
83 | git show --pretty=short --show-signature $commit >actual && | |
84 | grep "Good signature from" actual && | |
85 | ! grep "BAD signature from" actual && | |
86 | grep "not certified" actual && | |
87 | echo $commit OK || exit 1 | |
247503f2 JH |
88 | done |
89 | ) | |
90 | ' | |
91 | ||
434060ec | 92 | test_expect_success GPG 'verify-commit exits success on untrusted signature' ' |
8e98e5f2 | 93 | git verify-commit eighth-signed-alt 2>actual && |
94 | grep "Good signature from" actual && | |
95 | ! grep "BAD signature from" actual && | |
96 | grep "not certified" actual | |
97 | ' | |
98 | ||
aeff29dd | 99 | test_expect_success GPG 'verify signatures with --raw' ' |
100 | ( | |
101 | for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed | |
102 | do | |
103 | git verify-commit --raw $commit 2>actual && | |
104 | grep "GOODSIG" actual && | |
105 | ! grep "BADSIG" actual && | |
106 | echo $commit OK || exit 1 | |
107 | done | |
108 | ) && | |
109 | ( | |
110 | for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned | |
111 | do | |
112 | test_must_fail git verify-commit --raw $commit 2>actual && | |
113 | ! grep "GOODSIG" actual && | |
114 | ! grep "BADSIG" actual && | |
115 | echo $commit OK || exit 1 | |
116 | done | |
117 | ) && | |
118 | ( | |
119 | for commit in eighth-signed-alt | |
120 | do | |
121 | git verify-commit --raw $commit 2>actual && | |
122 | grep "GOODSIG" actual && | |
123 | ! grep "BADSIG" actual && | |
124 | grep "TRUST_UNDEFINED" actual && | |
125 | echo $commit OK || exit 1 | |
126 | done | |
127 | ) | |
128 | ' | |
129 | ||
8e92c2cf MG |
130 | test_expect_success GPG 'show signed commit with signature' ' |
131 | git show -s initial >commit && | |
132 | git show -s --show-signature initial >show && | |
133 | git verify-commit -v initial >verify.1 2>verify.2 && | |
134 | git cat-file commit initial >cat && | |
3f88c1b5 KM |
135 | grep -v -e "gpg: " -e "Warning: " show >show.commit && |
136 | grep -e "gpg: " -e "Warning: " show >show.gpg && | |
8e92c2cf MG |
137 | grep -v "^ " cat | grep -v "^gpgsig " >cat.commit && |
138 | test_cmp show.commit commit && | |
139 | test_cmp show.gpg verify.2 && | |
140 | test_cmp cat.commit verify.1 | |
141 | ' | |
142 | ||
247503f2 | 143 | test_expect_success GPG 'detect fudged signature' ' |
526d56e0 | 144 | git cat-file commit seventh-signed >raw && |
2f3cbcd8 | 145 | sed -e "s/^seventh/7th forged/" raw >forged1 && |
247503f2 | 146 | git hash-object -w -t commit forged1 >forged1.commit && |
9dd39821 | 147 | test_must_fail git verify-commit $(cat forged1.commit) && |
247503f2 JH |
148 | git show --pretty=short --show-signature $(cat forged1.commit) >actual1 && |
149 | grep "BAD signature from" actual1 && | |
150 | ! grep "Good signature from" actual1 | |
151 | ' | |
152 | ||
153 | test_expect_success GPG 'detect fudged signature with NUL' ' | |
526d56e0 | 154 | git cat-file commit seventh-signed >raw && |
247503f2 JH |
155 | cat raw >forged2 && |
156 | echo Qwik | tr "Q" "\000" >>forged2 && | |
157 | git hash-object -w -t commit forged2 >forged2.commit && | |
9dd39821 | 158 | test_must_fail git verify-commit $(cat forged2.commit) && |
247503f2 JH |
159 | git show --pretty=short --show-signature $(cat forged2.commit) >actual2 && |
160 | grep "BAD signature from" actual2 && | |
161 | ! grep "Good signature from" actual2 | |
162 | ' | |
163 | ||
c871a1d1 JH |
164 | test_expect_success GPG 'amending already signed commit' ' |
165 | git checkout fourth-signed^0 && | |
166 | git commit --amend -S --no-edit && | |
8e92c2cf | 167 | git verify-commit HEAD && |
c871a1d1 JH |
168 | git show -s --show-signature HEAD >actual && |
169 | grep "Good signature from" actual && | |
170 | ! grep "BAD signature from" actual | |
171 | ' | |
172 | ||
06ca0f45 JK |
173 | test_expect_success GPG 'show good signature with custom format' ' |
174 | cat >expect <<-\EOF && | |
175 | G | |
176 | 13B6F51ECDDE430D | |
177 | C O Mitter <committer@example.com> | |
178 | EOF | |
179 | git log -1 --format="%G?%n%GK%n%GS" sixth-signed >actual && | |
180 | test_cmp expect actual | |
181 | ' | |
182 | ||
183 | test_expect_success GPG 'show bad signature with custom format' ' | |
184 | cat >expect <<-\EOF && | |
185 | B | |
186 | 13B6F51ECDDE430D | |
187 | C O Mitter <committer@example.com> | |
188 | EOF | |
189 | git log -1 --format="%G?%n%GK%n%GS" $(cat forged1.commit) >actual && | |
190 | test_cmp expect actual | |
191 | ' | |
192 | ||
661a1806 | 193 | test_expect_success GPG 'show untrusted signature with custom format' ' |
06ca0f45 JK |
194 | cat >expect <<-\EOF && |
195 | U | |
196 | 61092E85B7227189 | |
197 | Eris Discordia <discord@example.net> | |
198 | EOF | |
199 | git log -1 --format="%G?%n%GK%n%GS" eighth-signed-alt >actual && | |
200 | test_cmp expect actual | |
201 | ' | |
202 | ||
661a1806 MG |
203 | test_expect_success GPG 'show unknown signature with custom format' ' |
204 | cat >expect <<-\EOF && | |
205 | E | |
206 | 61092E85B7227189 | |
207 | ||
208 | EOF | |
209 | GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS" eighth-signed-alt >actual && | |
210 | test_cmp expect actual | |
211 | ' | |
212 | ||
06ca0f45 JK |
213 | test_expect_success GPG 'show lack of signature with custom format' ' |
214 | cat >expect <<-\EOF && | |
215 | N | |
216 | ||
217 | ||
218 | EOF | |
219 | git log -1 --format="%G?%n%GK%n%GS" seventh-unsigned >actual && | |
220 | test_cmp expect actual | |
221 | ' | |
222 | ||
fce04c3c MJ |
223 | test_expect_success GPG 'log.showsignature behaves like --show-signature' ' |
224 | test_config log.showsignature true && | |
225 | git show initial >actual && | |
226 | grep "gpg: Signature made" actual && | |
227 | grep "gpg: Good signature" actual | |
228 | ' | |
229 | ||
1865a647 HS |
230 | test_expect_success GPG 'check config gpg.format values' ' |
231 | test_config gpg.format openpgp && | |
232 | git commit -S --amend -m "success" && | |
233 | test_config gpg.format OpEnPgP && | |
234 | test_must_fail git commit -S --amend -m "fail" | |
235 | ' | |
236 | ||
247503f2 | 237 | test_done |