[thirdparty/git.git] / t / t7510-signed-commit.sh

#!/bin/sh

test_description='signed commit tests'
. ./test-lib.sh
GNUPGHOME_NOT_USED=$GNUPGHOME
. "$TEST_DIRECTORY/lib-gpg.sh"

test_expect_success GPG 'create signed commits' '
	test_oid_cache <<-\EOF &&
	header sha1:gpgsig
	header sha256:gpgsig-sha256
	EOF

	test_when_finished "test_unconfig commit.gpgsign" &&

	echo 1 >file && git add file &&
	test_tick && git commit -S -m initial &&
	git tag initial &&
	git branch side &&

	echo 2 >file && test_tick && git commit -a -S -m second &&
	git tag second &&

	git checkout side &&
	echo 3 >elif && git add elif &&
	test_tick && git commit -m "third on side" &&

	git checkout master &&
	test_tick && git merge -S side &&
	git tag merge &&

	echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
	git tag fourth-unsigned &&

	test_tick && git commit --amend -S -m "fourth signed" &&
	git tag fourth-signed &&

	git config commit.gpgsign true &&
	echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
	git tag fifth-signed &&

	git config commit.gpgsign false &&
	echo 6 >file && test_tick && git commit -a -m "sixth" &&
	git tag sixth-unsigned &&

	git config commit.gpgsign true &&
	echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
	git tag seventh-unsigned &&

	test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
	git tag seventh-signed &&

	echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
	git tag eighth-signed-alt &&

	# commit.gpgsign is still on but this must not be signed
	echo 9 | git commit-tree HEAD^{tree} >oid &&
	test_line_count = 1 oid &&
	git tag ninth-unsigned $(cat oid) &&
	# explicit -S of course must sign.
	echo 10 | git commit-tree -S HEAD^{tree} >oid &&
	test_line_count = 1 oid &&
	git tag tenth-signed $(cat oid) &&

	# --gpg-sign[=<key-id>] must sign.
	echo 11 | git commit-tree --gpg-sign HEAD^{tree} >oid &&
	test_line_count = 1 oid &&
	git tag eleventh-signed $(cat oid) &&
	echo 12 | git commit-tree --gpg-sign=B7227189 HEAD^{tree} >oid &&
	test_line_count = 1 oid &&
	git tag twelfth-signed-alt $(cat oid)
'

test_expect_success GPG 'verify and show signatures' '
	(
		for commit in initial second merge fourth-signed \
			fifth-signed sixth-signed seventh-signed tenth-signed \
			eleventh-signed
		do
			git verify-commit $commit &&
			git show --pretty=short --show-signature $commit >actual &&
			grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in merge^2 fourth-unsigned sixth-unsigned \
			seventh-unsigned ninth-unsigned
		do
			test_must_fail git verify-commit $commit &&
			git show --pretty=short --show-signature $commit >actual &&
			! grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in eighth-signed-alt twelfth-signed-alt
		do
			git show --pretty=short --show-signature $commit >actual &&
			grep "Good signature from" actual &&
			! grep "BAD signature from" actual &&
			grep "not certified" actual &&
			echo $commit OK || exit 1
		done
	)
'

test_expect_success GPG 'verify-commit exits success on untrusted signature' '
	git verify-commit eighth-signed-alt 2>actual &&
	grep "Good signature from" actual &&
	! grep "BAD signature from" actual &&
	grep "not certified" actual
'

test_expect_success GPG 'verify-commit exits success with matching minTrustLevel' '
	test_config gpg.minTrustLevel ultimate &&
	git verify-commit sixth-signed
'

test_expect_success GPG 'verify-commit exits success with low minTrustLevel' '
	test_config gpg.minTrustLevel fully &&
	git verify-commit sixth-signed
'

test_expect_success GPG 'verify-commit exits failure with high minTrustLevel' '
	test_config gpg.minTrustLevel ultimate &&
	test_must_fail git verify-commit eighth-signed-alt
'

test_expect_success GPG 'verify signatures with --raw' '
	(
		for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
		do
			git verify-commit --raw $commit 2>actual &&
			grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
		do
			test_must_fail git verify-commit --raw $commit 2>actual &&
			! grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			echo $commit OK || exit 1
		done
	) &&
	(
		for commit in eighth-signed-alt
		do
			git verify-commit --raw $commit 2>actual &&
			grep "GOODSIG" actual &&
			! grep "BADSIG" actual &&
			grep "TRUST_UNDEFINED" actual &&
			echo $commit OK || exit 1
		done
	)
'

test_expect_success GPG 'proper header is used for hash algorithm' '
	git cat-file commit fourth-signed >output &&
	grep "^$(test_oid header) -----BEGIN PGP SIGNATURE-----" output
'

test_expect_success GPG 'show signed commit with signature' '
	git show -s initial >commit &&
	git show -s --show-signature initial >show &&
	git verify-commit -v initial >verify.1 2>verify.2 &&
	git cat-file commit initial >cat &&
	grep -v -e "gpg: " -e "Warning: " show >show.commit &&
	grep -e "gpg: " -e "Warning: " show >show.gpg &&
	grep -v "^ " cat | grep -v "^$(test_oid header) " >cat.commit &&
	test_cmp show.commit commit &&
	test_cmp show.gpg verify.2 &&
	test_cmp cat.commit verify.1
'

test_expect_success GPG 'detect fudged signature' '
	git cat-file commit seventh-signed >raw &&
	sed -e "s/^seventh/7th forged/" raw >forged1 &&
	git hash-object -w -t commit forged1 >forged1.commit &&
	test_must_fail git verify-commit $(cat forged1.commit) &&
	git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
	grep "BAD signature from" actual1 &&
	! grep "Good signature from" actual1
'

test_expect_success GPG 'detect fudged signature with NUL' '
	git cat-file commit seventh-signed >raw &&
	cat raw >forged2 &&
	echo Qwik | tr "Q" "\000" >>forged2 &&
	git hash-object -w -t commit forged2 >forged2.commit &&
	test_must_fail git verify-commit $(cat forged2.commit) &&
	git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
	grep "BAD signature from" actual2 &&
	! grep "Good signature from" actual2
'

test_expect_success GPG 'amending already signed commit' '
	git checkout fourth-signed^0 &&
	git commit --amend -S --no-edit &&
	git verify-commit HEAD &&
	git show -s --show-signature HEAD >actual &&
	grep "Good signature from" actual &&
	! grep "BAD signature from" actual
'

test_expect_success GPG 'show good signature with custom format' '
	cat >expect <<-\EOF &&
	G
	13B6F51ECDDE430D
	C O Mitter <committer@example.com>
	73D758744BE721698EC54E8713B6F51ECDDE430D
	73D758744BE721698EC54E8713B6F51ECDDE430D
	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show bad signature with custom format' '
	cat >expect <<-\EOF &&
	B
	13B6F51ECDDE430D
	C O Mitter <committer@example.com>


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat forged1.commit) >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show untrusted signature with custom format' '
	cat >expect <<-\EOF &&
	U
	65A0EEA02E30CAD7
	Eris Discordia <discord@example.net>
	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
	D4BE22311AD3131E5EDA29A461092E85B7227189
	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show untrusted signature with undefined trust level' '
	cat >expect <<-\EOF &&
	undefined
	65A0EEA02E30CAD7
	Eris Discordia <discord@example.net>
	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
	D4BE22311AD3131E5EDA29A461092E85B7227189
	EOF
	git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show untrusted signature with ultimate trust level' '
	cat >expect <<-\EOF &&
	ultimate
	13B6F51ECDDE430D
	C O Mitter <committer@example.com>
	73D758744BE721698EC54E8713B6F51ECDDE430D
	73D758744BE721698EC54E8713B6F51ECDDE430D
	EOF
	git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show unknown signature with custom format' '
	cat >expect <<-\EOF &&
	E
	65A0EEA02E30CAD7


	EOF
	GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'show lack of signature with custom format' '
	cat >expect <<-\EOF &&
	N


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" seventh-unsigned >actual &&
	test_cmp expect actual
'

test_expect_success GPG 'log.showsignature behaves like --show-signature' '
	test_config log.showsignature true &&
	git show initial >actual &&
	grep "gpg: Signature made" actual &&
	grep "gpg: Good signature" actual
'

test_expect_success GPG 'check config gpg.format values' '
	test_config gpg.format openpgp &&
	git commit -S --amend -m "success" &&
	test_config gpg.format OpEnPgP &&
	test_must_fail git commit -S --amend -m "fail"
'

test_expect_success GPG 'detect fudged commit with double signature' '
	sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
	sed -n -e "/gpgsig/,/END PGP/p" forged1 | \
		sed -e "s/^$(test_oid header)//;s/^ //" | gpg --dearmor >double-sig1.sig &&
	gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
	cat double-sig1.sig double-sig2.sig | gpg --enarmor >double-combined.asc &&
	sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/$(test_oid header) /;2,\$s/^/ /" \
		double-combined.asc > double-gpgsig &&
	sed -e "/committer/r double-gpgsig" double-base >double-commit &&
	git hash-object -w -t commit double-commit >double-commit.commit &&
	test_must_fail git verify-commit $(cat double-commit.commit) &&
	git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
	grep "BAD signature from" double-actual &&
	grep "Good signature from" double-actual
'

test_expect_success GPG 'show double signature with custom format' '
	cat >expect <<-\EOF &&
	E


	EOF
	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat double-commit.commit) >actual &&
	test_cmp expect actual
'

test_done
Commit	Line	Data
247503f2 JH	1	#!/bin/sh
	2
	3	test_description='signed commit tests'
	4	. ./test-lib.sh
661a1806	5	GNUPGHOME_NOT_USED=$GNUPGHOME
247503f2 JH	6	. "$TEST_DIRECTORY/lib-gpg.sh"
	7
	8	test_expect_success GPG 'create signed commits' '
42d4e1d1	9	test_oid_cache <<-\EOF &&
	10	header sha1:gpgsig
	11	header sha256:gpgsig-sha256
	12	EOF
	13
4b8d14b4 NV	14	test_when_finished "test_unconfig commit.gpgsign" &&
4b8d14b4 NV	15
247503f2 JH	16	echo 1 >file && git add file &&
	17	test_tick && git commit -S -m initial &&
	18	git tag initial &&
	19	git branch side &&
	20
	21	echo 2 >file && test_tick && git commit -a -S -m second &&
	22	git tag second &&
	23
	24	git checkout side &&
	25	echo 3 >elif && git add elif &&
	26	test_tick && git commit -m "third on side" &&
	27
	28	git checkout master &&
	29	test_tick && git merge -S side &&
	30	git tag merge &&
	31
	32	echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
	33	git tag fourth-unsigned &&
	34
c871a1d1	35	test_tick && git commit --amend -S -m "fourth signed" &&
4b8d14b4 NV	36	git tag fourth-signed &&
	37
	38	git config commit.gpgsign true &&
	39	echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
	40	git tag fifth-signed &&
	41
	42	git config commit.gpgsign false &&
	43	echo 6 >file && test_tick && git commit -a -m "sixth" &&
	44	git tag sixth-unsigned &&
	45
	46	git config commit.gpgsign true &&
	47	echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
	48	git tag seventh-unsigned &&
	49
	50	test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
99094a7a	51	git tag seventh-signed &&
4baf839f JK	52
4baf839f JK	53	echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
66948561 JH	54	git tag eighth-signed-alt &&
	55
	56	# commit.gpgsign is still on but this must not be signed
41a74bd0 MÅ	57	echo 9 \| git commit-tree HEAD^{tree} >oid &&
	58	test_line_count = 1 oid &&
	59	git tag ninth-unsigned $(cat oid) &&
66948561	60	# explicit -S of course must sign.
41a74bd0 MÅ	61	echo 10 \| git commit-tree -S HEAD^{tree} >oid &&
41a74bd0 MÅ	62	test_line_count = 1 oid &&
70ddbd77 BR	63	git tag tenth-signed $(cat oid) &&
	64
	65	# --gpg-sign[=<key-id>] must sign.
	66	echo 11 \| git commit-tree --gpg-sign HEAD^{tree} >oid &&
	67	test_line_count = 1 oid &&
	68	git tag eleventh-signed $(cat oid) &&
	69	echo 12 \| git commit-tree --gpg-sign=B7227189 HEAD^{tree} >oid &&
	70	test_line_count = 1 oid &&
	71	git tag twelfth-signed-alt $(cat oid)
247503f2 JH	72	'
247503f2 JH	73
8e92c2cf	74	test_expect_success GPG 'verify and show signatures' '
247503f2	75	(
66948561	76	for commit in initial second merge fourth-signed \
70ddbd77 BR	77	fifth-signed sixth-signed seventh-signed tenth-signed \
70ddbd77 BR	78	eleventh-signed
247503f2	79	do
8e92c2cf	80	git verify-commit $commit &&
247503f2	81	git show --pretty=short --show-signature $commit >actual &&
7b1732c1 MG	82	grep "Good signature from" actual &&
	83	! grep "BAD signature from" actual &&
	84	echo $commit OK \|\| exit 1
247503f2 JH	85	done
	86	) &&
	87	(
66948561 JH	88	for commit in merge^2 fourth-unsigned sixth-unsigned \
66948561 JH	89	seventh-unsigned ninth-unsigned
247503f2	90	do
8e92c2cf	91	test_must_fail git verify-commit $commit &&
247503f2	92	git show --pretty=short --show-signature $commit >actual &&
7b1732c1 MG	93	! grep "Good signature from" actual &&
	94	! grep "BAD signature from" actual &&
	95	echo $commit OK \|\| exit 1
4baf839f JK	96	done
	97	) &&
	98	(
70ddbd77	99	for commit in eighth-signed-alt twelfth-signed-alt
4baf839f JK	100	do
	101	git show --pretty=short --show-signature $commit >actual &&
	102	grep "Good signature from" actual &&
	103	! grep "BAD signature from" actual &&
	104	grep "not certified" actual &&
	105	echo $commit OK \|\| exit 1
247503f2 JH	106	done
	107	)
	108	'
	109
434060ec	110	test_expect_success GPG 'verify-commit exits success on untrusted signature' '
8e98e5f2	111	git verify-commit eighth-signed-alt 2>actual &&
	112	grep "Good signature from" actual &&
	113	! grep "BAD signature from" actual &&
	114	grep "not certified" actual
	115	'
	116
54887b46 HJI	117	test_expect_success GPG 'verify-commit exits success with matching minTrustLevel' '
	118	test_config gpg.minTrustLevel ultimate &&
	119	git verify-commit sixth-signed
	120	'
	121
	122	test_expect_success GPG 'verify-commit exits success with low minTrustLevel' '
	123	test_config gpg.minTrustLevel fully &&
	124	git verify-commit sixth-signed
	125	'
	126
	127	test_expect_success GPG 'verify-commit exits failure with high minTrustLevel' '
	128	test_config gpg.minTrustLevel ultimate &&
	129	test_must_fail git verify-commit eighth-signed-alt
	130	'
	131
aeff29dd	132	test_expect_success GPG 'verify signatures with --raw' '
	133	(
	134	for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
	135	do
	136	git verify-commit --raw $commit 2>actual &&
	137	grep "GOODSIG" actual &&
	138	! grep "BADSIG" actual &&
	139	echo $commit OK \|\| exit 1
	140	done
	141	) &&
	142	(
	143	for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
	144	do
	145	test_must_fail git verify-commit --raw $commit 2>actual &&
	146	! grep "GOODSIG" actual &&
	147	! grep "BADSIG" actual &&
	148	echo $commit OK \|\| exit 1
	149	done
	150	) &&
	151	(
	152	for commit in eighth-signed-alt
	153	do
	154	git verify-commit --raw $commit 2>actual &&
	155	grep "GOODSIG" actual &&
	156	! grep "BADSIG" actual &&
	157	grep "TRUST_UNDEFINED" actual &&
	158	echo $commit OK \|\| exit 1
	159	done
	160	)
	161	'
	162
42d4e1d1	163	test_expect_success GPG 'proper header is used for hash algorithm' '
	164	git cat-file commit fourth-signed >output &&
	165	grep "^$(test_oid header) -----BEGIN PGP SIGNATURE-----" output
	166	'
	167
8e92c2cf MG	168	test_expect_success GPG 'show signed commit with signature' '
	169	git show -s initial >commit &&
	170	git show -s --show-signature initial >show &&
	171	git verify-commit -v initial >verify.1 2>verify.2 &&
	172	git cat-file commit initial >cat &&
3f88c1b5 KM	173	grep -v -e "gpg: " -e "Warning: " show >show.commit &&
3f88c1b5 KM	174	grep -e "gpg: " -e "Warning: " show >show.gpg &&
42d4e1d1	175	grep -v "^ " cat \| grep -v "^$(test_oid header) " >cat.commit &&
8e92c2cf MG	176	test_cmp show.commit commit &&
	177	test_cmp show.gpg verify.2 &&
	178	test_cmp cat.commit verify.1
	179	'
	180
247503f2	181	test_expect_success GPG 'detect fudged signature' '
526d56e0	182	git cat-file commit seventh-signed >raw &&
2f3cbcd8	183	sed -e "s/^seventh/7th forged/" raw >forged1 &&
247503f2	184	git hash-object -w -t commit forged1 >forged1.commit &&
9dd39821	185	test_must_fail git verify-commit $(cat forged1.commit) &&
247503f2 JH	186	git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
	187	grep "BAD signature from" actual1 &&
	188	! grep "Good signature from" actual1
	189	'
	190
	191	test_expect_success GPG 'detect fudged signature with NUL' '
526d56e0	192	git cat-file commit seventh-signed >raw &&
247503f2 JH	193	cat raw >forged2 &&
	194	echo Qwik \| tr "Q" "\000" >>forged2 &&
	195	git hash-object -w -t commit forged2 >forged2.commit &&
9dd39821	196	test_must_fail git verify-commit $(cat forged2.commit) &&
247503f2 JH	197	git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
	198	grep "BAD signature from" actual2 &&
	199	! grep "Good signature from" actual2
	200	'
	201
c871a1d1 JH	202	test_expect_success GPG 'amending already signed commit' '
	203	git checkout fourth-signed^0 &&
	204	git commit --amend -S --no-edit &&
8e92c2cf	205	git verify-commit HEAD &&
c871a1d1 JH	206	git show -s --show-signature HEAD >actual &&
	207	grep "Good signature from" actual &&
	208	! grep "BAD signature from" actual
	209	'
	210
06ca0f45 JK	211	test_expect_success GPG 'show good signature with custom format' '
	212	cat >expect <<-\EOF &&
	213	G
	214	13B6F51ECDDE430D
	215	C O Mitter <committer@example.com>
3daaaabe	216	73D758744BE721698EC54E8713B6F51ECDDE430D
1a550529	217	73D758744BE721698EC54E8713B6F51ECDDE430D
06ca0f45	218	EOF
1a550529	219	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
06ca0f45 JK	220	test_cmp expect actual
	221	'
	222
	223	test_expect_success GPG 'show bad signature with custom format' '
	224	cat >expect <<-\EOF &&
	225	B
	226	13B6F51ECDDE430D
	227	C O Mitter <committer@example.com>
3daaaabe	228
1a550529	229
06ca0f45	230	EOF
1a550529	231	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat forged1.commit) >actual &&
06ca0f45 JK	232	test_cmp expect actual
	233	'
	234
661a1806	235	test_expect_success GPG 'show untrusted signature with custom format' '
06ca0f45 JK	236	cat >expect <<-\EOF &&
06ca0f45 JK	237	U
1e690847	238	65A0EEA02E30CAD7
06ca0f45	239	Eris Discordia <discord@example.net>
1e690847	240	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
1a550529	241	D4BE22311AD3131E5EDA29A461092E85B7227189
06ca0f45	242	EOF
1a550529	243	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
06ca0f45 JK	244	test_cmp expect actual
	245	'
	246
54887b46 HJI	247	test_expect_success GPG 'show untrusted signature with undefined trust level' '
	248	cat >expect <<-\EOF &&
	249	undefined
	250	65A0EEA02E30CAD7
	251	Eris Discordia <discord@example.net>
	252	F8364A59E07FFE9F4D63005A65A0EEA02E30CAD7
	253	D4BE22311AD3131E5EDA29A461092E85B7227189
	254	EOF
	255	git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
	256	test_cmp expect actual
	257	'
	258
	259	test_expect_success GPG 'show untrusted signature with ultimate trust level' '
	260	cat >expect <<-\EOF &&
	261	ultimate
	262	13B6F51ECDDE430D
	263	C O Mitter <committer@example.com>
	264	73D758744BE721698EC54E8713B6F51ECDDE430D
	265	73D758744BE721698EC54E8713B6F51ECDDE430D
	266	EOF
	267	git log -1 --format="%GT%n%GK%n%GS%n%GF%n%GP" sixth-signed >actual &&
	268	test_cmp expect actual
	269	'
	270
661a1806 MG	271	test_expect_success GPG 'show unknown signature with custom format' '
	272	cat >expect <<-\EOF &&
	273	E
1e690847	274	65A0EEA02E30CAD7
661a1806	275
3daaaabe	276
1a550529	277
661a1806	278	EOF
1a550529	279	GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" eighth-signed-alt >actual &&
661a1806 MG	280	test_cmp expect actual
	281	'
	282
06ca0f45 JK	283	test_expect_success GPG 'show lack of signature with custom format' '
	284	cat >expect <<-\EOF &&
	285	N
	286
	287
3daaaabe	288
1a550529	289
06ca0f45	290	EOF
1a550529	291	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" seventh-unsigned >actual &&
06ca0f45 JK	292	test_cmp expect actual
	293	'
	294
fce04c3c MJ	295	test_expect_success GPG 'log.showsignature behaves like --show-signature' '
	296	test_config log.showsignature true &&
	297	git show initial >actual &&
	298	grep "gpg: Signature made" actual &&
	299	grep "gpg: Good signature" actual
	300	'
	301
1865a647 HS	302	test_expect_success GPG 'check config gpg.format values' '
	303	test_config gpg.format openpgp &&
	304	git commit -S --amend -m "success" &&
	305	test_config gpg.format OpEnPgP &&
	306	test_must_fail git commit -S --amend -m "fail"
	307	'
	308
da6cf1b3 MG	309	test_expect_success GPG 'detect fudged commit with double signature' '
	310	sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
	311	sed -n -e "/gpgsig/,/END PGP/p" forged1 \| \
42d4e1d1	312	sed -e "s/^$(test_oid header)//;s/^ //" \| gpg --dearmor >double-sig1.sig &&
da6cf1b3 MG	313	gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
da6cf1b3 MG	314	cat double-sig1.sig double-sig2.sig \| gpg --enarmor >double-combined.asc &&
42d4e1d1	315	sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/$(test_oid header) /;2,\$s/^/ /" \
da6cf1b3 MG	316	double-combined.asc > double-gpgsig &&
	317	sed -e "/committer/r double-gpgsig" double-base >double-commit &&
	318	git hash-object -w -t commit double-commit >double-commit.commit &&
	319	test_must_fail git verify-commit $(cat double-commit.commit) &&
	320	git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
	321	grep "BAD signature from" double-actual &&
	322	grep "Good signature from" double-actual
	323	'
	324
	325	test_expect_success GPG 'show double signature with custom format' '
	326	cat >expect <<-\EOF &&
	327	E
	328
	329
3daaaabe	330
1a550529	331
da6cf1b3	332	EOF
1a550529	333	git log -1 --format="%G?%n%GK%n%GS%n%GF%n%GP" $(cat double-commit.commit) >actual &&
da6cf1b3 MG	334	test_cmp expect actual
	335	'
	336
247503f2	337	test_done