]>
Commit | Line | Data |
---|---|---|
2f47eae2 JH |
1 | #include "cache.h" |
2 | #include "run-command.h" | |
3 | #include "strbuf.h" | |
4 | #include "gpg-interface.h" | |
5 | #include "sigchain.h" | |
4322353b | 6 | #include "tempfile.h" |
2f47eae2 JH |
7 | |
8 | static char *configured_signing_key; | |
0c5e70f0 | 9 | static const char *gpg_program = "gpg"; |
2f47eae2 | 10 | |
d7c67668 JH |
11 | #define PGP_SIGNATURE "-----BEGIN PGP SIGNATURE-----" |
12 | #define PGP_MESSAGE "-----BEGIN PGP MESSAGE-----" | |
13 | ||
01e57b5d MG |
14 | void signature_check_clear(struct signature_check *sigc) |
15 | { | |
71c214c8 | 16 | free(sigc->payload); |
01e57b5d MG |
17 | free(sigc->gpg_output); |
18 | free(sigc->gpg_status); | |
19 | free(sigc->signer); | |
20 | free(sigc->key); | |
71c214c8 | 21 | sigc->payload = NULL; |
01e57b5d MG |
22 | sigc->gpg_output = NULL; |
23 | sigc->gpg_status = NULL; | |
24 | sigc->signer = NULL; | |
25 | sigc->key = NULL; | |
26 | } | |
27 | ||
a50e7ca3 JH |
28 | static struct { |
29 | char result; | |
30 | const char *check; | |
31 | } sigcheck_gpg_status[] = { | |
32 | { 'G', "\n[GNUPG:] GOODSIG " }, | |
33 | { 'B', "\n[GNUPG:] BADSIG " }, | |
34 | { 'U', "\n[GNUPG:] TRUST_NEVER" }, | |
35 | { 'U', "\n[GNUPG:] TRUST_UNDEFINED" }, | |
36 | }; | |
37 | ||
38 | void parse_gpg_output(struct signature_check *sigc) | |
39 | { | |
40 | const char *buf = sigc->gpg_status; | |
41 | int i; | |
42 | ||
43 | /* Iterate over all search strings */ | |
44 | for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) { | |
45 | const char *found, *next; | |
46 | ||
47 | if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) { | |
48 | found = strstr(buf, sigcheck_gpg_status[i].check); | |
49 | if (!found) | |
50 | continue; | |
51 | found += strlen(sigcheck_gpg_status[i].check); | |
52 | } | |
53 | sigc->result = sigcheck_gpg_status[i].result; | |
54 | /* The trust messages are not followed by key/signer information */ | |
55 | if (sigc->result != 'U') { | |
56 | sigc->key = xmemdupz(found, 16); | |
57 | found += 17; | |
58 | next = strchrnul(found, '\n'); | |
59 | sigc->signer = xmemdupz(found, next - found); | |
60 | } | |
61 | } | |
62 | } | |
63 | ||
434060ec | 64 | int check_signature(const char *payload, size_t plen, const char *signature, |
a4cc18f2 | 65 | size_t slen, struct signature_check *sigc) |
66 | { | |
67 | struct strbuf gpg_output = STRBUF_INIT; | |
68 | struct strbuf gpg_status = STRBUF_INIT; | |
69 | int status; | |
70 | ||
71 | sigc->result = 'N'; | |
72 | ||
73 | status = verify_signed_buffer(payload, plen, signature, slen, | |
74 | &gpg_output, &gpg_status); | |
75 | if (status && !gpg_output.len) | |
76 | goto out; | |
77 | sigc->payload = xmemdupz(payload, plen); | |
78 | sigc->gpg_output = strbuf_detach(&gpg_output, NULL); | |
79 | sigc->gpg_status = strbuf_detach(&gpg_status, NULL); | |
80 | parse_gpg_output(sigc); | |
81 | ||
82 | out: | |
83 | strbuf_release(&gpg_status); | |
84 | strbuf_release(&gpg_output); | |
434060ec | 85 | |
86 | return sigc->result != 'G' && sigc->result != 'U'; | |
a4cc18f2 | 87 | } |
88 | ||
ca194d50 | 89 | void print_signature_buffer(const struct signature_check *sigc, unsigned flags) |
90 | { | |
aeff29dd | 91 | const char *output = flags & GPG_VERIFY_RAW ? |
92 | sigc->gpg_status : sigc->gpg_output; | |
93 | ||
ca194d50 | 94 | if (flags & GPG_VERIFY_VERBOSE && sigc->payload) |
95 | fputs(sigc->payload, stdout); | |
96 | ||
aeff29dd | 97 | if (output) |
98 | fputs(output, stderr); | |
ca194d50 | 99 | } |
100 | ||
d7c67668 JH |
101 | /* |
102 | * Look at GPG signed content (e.g. a signed tag object), whose | |
103 | * payload is followed by a detached signature on it. Return the | |
104 | * offset where the embedded detached signature begins, or the end of | |
105 | * the data when there is no such signature. | |
106 | */ | |
107 | size_t parse_signature(const char *buf, unsigned long size) | |
108 | { | |
109 | char *eol; | |
110 | size_t len = 0; | |
111 | while (len < size && !starts_with(buf + len, PGP_SIGNATURE) && | |
112 | !starts_with(buf + len, PGP_MESSAGE)) { | |
113 | eol = memchr(buf + len, '\n', size - len); | |
114 | len += eol ? eol - (buf + len) + 1 : size - len; | |
115 | } | |
116 | return len; | |
117 | } | |
118 | ||
2f47eae2 JH |
119 | void set_signing_key(const char *key) |
120 | { | |
121 | free(configured_signing_key); | |
122 | configured_signing_key = xstrdup(key); | |
123 | } | |
124 | ||
125 | int git_gpg_config(const char *var, const char *value, void *cb) | |
126 | { | |
127 | if (!strcmp(var, "user.signingkey")) { | |
0c5e70f0 JH |
128 | set_signing_key(value); |
129 | } | |
130 | if (!strcmp(var, "gpg.program")) { | |
2f47eae2 JH |
131 | if (!value) |
132 | return config_error_nonbool(var); | |
0c5e70f0 | 133 | gpg_program = xstrdup(value); |
2f47eae2 JH |
134 | } |
135 | return 0; | |
136 | } | |
137 | ||
138 | const char *get_signing_key(void) | |
139 | { | |
140 | if (configured_signing_key) | |
141 | return configured_signing_key; | |
f9bc573f | 142 | return git_committer_info(IDENT_STRICT|IDENT_NO_DATE); |
2f47eae2 JH |
143 | } |
144 | ||
145 | /* | |
146 | * Create a detached signature for the contents of "buffer" and append | |
147 | * it after "signature"; "buffer" and "signature" can be the same | |
148 | * strbuf instance, which would cause the detached signature appended | |
149 | * at the end. | |
150 | */ | |
151 | int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key) | |
152 | { | |
d3180279 | 153 | struct child_process gpg = CHILD_PROCESS_INIT; |
2f47eae2 JH |
154 | ssize_t len; |
155 | size_t i, j, bottom; | |
156 | ||
2f47eae2 JH |
157 | gpg.in = -1; |
158 | gpg.out = -1; | |
aedb5dc3 JK |
159 | argv_array_pushl(&gpg.args, |
160 | gpg_program, | |
161 | "-bsau", signing_key, | |
162 | NULL); | |
2f47eae2 JH |
163 | |
164 | if (start_command(&gpg)) | |
165 | return error(_("could not run gpg.")); | |
166 | ||
167 | /* | |
168 | * When the username signingkey is bad, program could be terminated | |
169 | * because gpg exits without reading and then write gets SIGPIPE. | |
170 | */ | |
171 | sigchain_push(SIGPIPE, SIG_IGN); | |
172 | ||
173 | if (write_in_full(gpg.in, buffer->buf, buffer->len) != buffer->len) { | |
174 | close(gpg.in); | |
175 | close(gpg.out); | |
176 | finish_command(&gpg); | |
177 | return error(_("gpg did not accept the data")); | |
178 | } | |
179 | close(gpg.in); | |
180 | ||
181 | bottom = signature->len; | |
182 | len = strbuf_read(signature, gpg.out, 1024); | |
183 | close(gpg.out); | |
184 | ||
185 | sigchain_pop(SIGPIPE); | |
186 | ||
187 | if (finish_command(&gpg) || !len || len < 0) | |
188 | return error(_("gpg failed to sign the data")); | |
189 | ||
190 | /* Strip CR from the line endings, in case we are on Windows. */ | |
191 | for (i = j = bottom; i < signature->len; i++) | |
192 | if (signature->buf[i] != '\r') { | |
193 | if (i != j) | |
194 | signature->buf[j] = signature->buf[i]; | |
195 | j++; | |
196 | } | |
197 | strbuf_setlen(signature, j); | |
198 | ||
199 | return 0; | |
200 | } | |
201 | ||
202 | /* | |
203 | * Run "gpg" to see if the payload matches the detached signature. | |
e3f55e07 | 204 | * gpg_output, when set, receives the diagnostic output from GPG. |
b60b7566 | 205 | * gpg_status, when set, receives the status output from GPG. |
2f47eae2 JH |
206 | */ |
207 | int verify_signed_buffer(const char *payload, size_t payload_size, | |
208 | const char *signature, size_t signature_size, | |
9cc4ac8f | 209 | struct strbuf *gpg_output, struct strbuf *gpg_status) |
2f47eae2 | 210 | { |
d3180279 | 211 | struct child_process gpg = CHILD_PROCESS_INIT; |
4322353b | 212 | static struct tempfile temp; |
2f47eae2 | 213 | int fd, ret; |
b60b7566 | 214 | struct strbuf buf = STRBUF_INIT; |
2f47eae2 | 215 | |
4322353b | 216 | fd = mks_tempfile_t(&temp, ".git_vtag_tmpXXXXXX"); |
2f47eae2 | 217 | if (fd < 0) |
4322353b JK |
218 | return error_errno(_("could not create temporary file")); |
219 | if (write_in_full(fd, signature, signature_size) < 0) { | |
220 | error_errno(_("failed writing detached signature to '%s'"), | |
221 | temp.filename.buf); | |
222 | delete_tempfile(&temp); | |
223 | return -1; | |
224 | } | |
2f47eae2 JH |
225 | close(fd); |
226 | ||
aedb5dc3 JK |
227 | argv_array_pushl(&gpg.args, |
228 | gpg_program, | |
229 | "--status-fd=1", | |
4322353b | 230 | "--verify", temp.filename.buf, "-", |
aedb5dc3 | 231 | NULL); |
2f47eae2 | 232 | gpg.in = -1; |
b60b7566 | 233 | gpg.out = -1; |
2f47eae2 JH |
234 | if (gpg_output) |
235 | gpg.err = -1; | |
2f47eae2 | 236 | if (start_command(&gpg)) { |
4322353b | 237 | delete_tempfile(&temp); |
4c9a4182 | 238 | return error(_("could not run gpg.")); |
2f47eae2 JH |
239 | } |
240 | ||
d281b45d | 241 | sigchain_push(SIGPIPE, SIG_IGN); |
2f47eae2 JH |
242 | write_in_full(gpg.in, payload, payload_size); |
243 | close(gpg.in); | |
244 | ||
7dac3f83 | 245 | if (gpg_output) { |
2f47eae2 | 246 | strbuf_read(gpg_output, gpg.err, 0); |
7dac3f83 SB |
247 | close(gpg.err); |
248 | } | |
c752fcc8 JK |
249 | if (!gpg_status) |
250 | gpg_status = &buf; | |
251 | strbuf_read(gpg_status, gpg.out, 0); | |
b60b7566 MG |
252 | close(gpg.out); |
253 | ||
2f47eae2 | 254 | ret = finish_command(&gpg); |
d281b45d | 255 | sigchain_pop(SIGPIPE); |
2f47eae2 | 256 | |
4322353b | 257 | delete_tempfile(&temp); |
2f47eae2 | 258 | |
c752fcc8 | 259 | ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG "); |
9cc4ac8f | 260 | strbuf_release(&buf); /* no matter it was used or not */ |
b60b7566 | 261 | |
2f47eae2 JH |
262 | return ret; |
263 | } |