[thirdparty/git.git] / gpg-interface.c

#include "cache.h"
#include "config.h"
#include "run-command.h"
#include "strbuf.h"
#include "gpg-interface.h"
#include "sigchain.h"
#include "tempfile.h"

static char *configured_signing_key;
struct gpg_format {
	const char *name;
	const char *program;
	const char **verify_args;
	const char **sigs;
};

static const char *openpgp_verify_args[] = {
	"--keyid-format=long",
	NULL
};
static const char *openpgp_sigs[] = {
	"-----BEGIN PGP SIGNATURE-----",
	"-----BEGIN PGP MESSAGE-----",
	NULL
};

static const char *x509_verify_args[] = {
	NULL
};
static const char *x509_sigs[] = {
	"-----BEGIN SIGNED MESSAGE-----",
	NULL
};

static struct gpg_format gpg_format[] = {
	{ .name = "openpgp", .program = "gpg",
	  .verify_args = openpgp_verify_args,
	  .sigs = openpgp_sigs
	},
	{ .name = "x509", .program = "gpgsm",
	  .verify_args = x509_verify_args,
	  .sigs = x509_sigs
	},
};

static struct gpg_format *use_format = &gpg_format[0];

static struct gpg_format *get_format_by_name(const char *str)
{
	int i;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		if (!strcmp(gpg_format[i].name, str))
			return gpg_format + i;
	return NULL;
}

static struct gpg_format *get_format_by_sig(const char *sig)
{
	int i, j;

	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
		for (j = 0; gpg_format[i].sigs[j]; j++)
			if (starts_with(sig, gpg_format[i].sigs[j]))
				return gpg_format + i;
	return NULL;
}

void signature_check_clear(struct signature_check *sigc)
{
	FREE_AND_NULL(sigc->payload);
	FREE_AND_NULL(sigc->gpg_output);
	FREE_AND_NULL(sigc->gpg_status);
	FREE_AND_NULL(sigc->signer);
	FREE_AND_NULL(sigc->key);
}

static struct {
	char result;
	const char *check;
} sigcheck_gpg_status[] = {
	{ 'G', "\n[GNUPG:] GOODSIG " },
	{ 'B', "\n[GNUPG:] BADSIG " },
	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
	{ 'E', "\n[GNUPG:] ERRSIG "},
	{ 'X', "\n[GNUPG:] EXPSIG "},
	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	{ 'R', "\n[GNUPG:] REVKEYSIG "},
};

static void parse_gpg_output(struct signature_check *sigc)
{
	const char *buf = sigc->gpg_status;
	int i;

	/* Iterate over all search strings */
	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
		const char *found, *next;

		if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
			found = strstr(buf, sigcheck_gpg_status[i].check);
			if (!found)
				continue;
			found += strlen(sigcheck_gpg_status[i].check);
		}
		sigc->result = sigcheck_gpg_status[i].result;
		/* The trust messages are not followed by key/signer information */
		if (sigc->result != 'U') {
			next = strchrnul(found, ' ');
			sigc->key = xmemdupz(found, next - found);
			/* The ERRSIG message is not followed by signer information */
			if (*next && sigc-> result != 'E') {
				found = next + 1;
				next = strchrnul(found, '\n');
				sigc->signer = xmemdupz(found, next - found);
			}
		}
	}
}

int check_signature(const char *payload, size_t plen, const char *signature,
	size_t slen, struct signature_check *sigc)
{
	struct strbuf gpg_output = STRBUF_INIT;
	struct strbuf gpg_status = STRBUF_INIT;
	int status;

	sigc->result = 'N';

	status = verify_signed_buffer(payload, plen, signature, slen,
				      &gpg_output, &gpg_status);
	if (status && !gpg_output.len)
		goto out;
	sigc->payload = xmemdupz(payload, plen);
	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	parse_gpg_output(sigc);
	status |= sigc->result != 'G' && sigc->result != 'U';

 out:
	strbuf_release(&gpg_status);
	strbuf_release(&gpg_output);

	return !!status;
}

void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
{
	const char *output = flags & GPG_VERIFY_RAW ?
		sigc->gpg_status : sigc->gpg_output;

	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
		fputs(sigc->payload, stdout);

	if (output)
		fputs(output, stderr);
}

size_t parse_signature(const char *buf, size_t size)
{
	size_t len = 0;
	size_t match = size;
	while (len < size) {
		const char *eol;

		if (get_format_by_sig(buf + len))
			match = len;

		eol = memchr(buf + len, '\n', size - len);
		len += eol ? eol - (buf + len) + 1 : size - len;
	}
	return match;
}

void set_signing_key(const char *key)
{
	free(configured_signing_key);
	configured_signing_key = xstrdup(key);
}

int git_gpg_config(const char *var, const char *value, void *cb)
{
	struct gpg_format *fmt = NULL;
	char *fmtname = NULL;

	if (!strcmp(var, "user.signingkey")) {
		if (!value)
			return config_error_nonbool(var);
		set_signing_key(value);
		return 0;
	}

	if (!strcmp(var, "gpg.format")) {
		if (!value)
			return config_error_nonbool(var);
		fmt = get_format_by_name(value);
		if (!fmt)
			return error("unsupported value for %s: %s",
				     var, value);
		use_format = fmt;
		return 0;
	}

	if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
		fmtname = "openpgp";

	if (!strcmp(var, "gpg.x509.program"))
		fmtname = "x509";

	if (fmtname) {
		fmt = get_format_by_name(fmtname);
		return git_config_string(&fmt->program, var, value);
	}

	return 0;
}

const char *get_signing_key(void)
{
	if (configured_signing_key)
		return configured_signing_key;
	return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
}

int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	int ret;
	size_t i, j, bottom;
	struct strbuf gpg_status = STRBUF_INIT;

	argv_array_pushl(&gpg.args,
			 use_format->program,
			 "--status-fd=2",
			 "-bsau", signing_key,
			 NULL);

	bottom = signature->len;

	/*
	 * When the username signingkey is bad, program could be terminated
	 * because gpg exits without reading and then write gets SIGPIPE.
	 */
	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, buffer->buf, buffer->len,
			   signature, 1024, &gpg_status, 0);
	sigchain_pop(SIGPIPE);

	ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	strbuf_release(&gpg_status);
	if (ret)
		return error(_("gpg failed to sign the data"));

	/* Strip CR from the line endings, in case we are on Windows. */
	for (i = j = bottom; i < signature->len; i++)
		if (signature->buf[i] != '\r') {
			if (i != j)
				signature->buf[j] = signature->buf[i];
			j++;
		}
	strbuf_setlen(signature, j);

	return 0;
}

int verify_signed_buffer(const char *payload, size_t payload_size,
			 const char *signature, size_t signature_size,
			 struct strbuf *gpg_output, struct strbuf *gpg_status)
{
	struct child_process gpg = CHILD_PROCESS_INIT;
	struct gpg_format *fmt;
	struct tempfile *temp;
	int ret;
	struct strbuf buf = STRBUF_INIT;

	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
	if (!temp)
		return error_errno(_("could not create temporary file"));
	if (write_in_full(temp->fd, signature, signature_size) < 0 ||
	    close_tempfile_gently(temp) < 0) {
		error_errno(_("failed writing detached signature to '%s'"),
			    temp->filename.buf);
		delete_tempfile(&temp);
		return -1;
	}

	fmt = get_format_by_sig(signature);
	if (!fmt)
		BUG("bad signature '%s'", signature);

	argv_array_push(&gpg.args, fmt->program);
	argv_array_pushv(&gpg.args, fmt->verify_args);
	argv_array_pushl(&gpg.args,
			 "--status-fd=1",
			 "--verify", temp->filename.buf, "-",
			 NULL);

	if (!gpg_status)
		gpg_status = &buf;

	sigchain_push(SIGPIPE, SIG_IGN);
	ret = pipe_command(&gpg, payload, payload_size,
			   gpg_status, 0, gpg_output, 0);
	sigchain_pop(SIGPIPE);

	delete_tempfile(&temp);

	ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
	strbuf_release(&buf); /* no matter it was used or not */

	return ret;
}
Commit	Line	Data
2f47eae2	1	#include "cache.h"
b2141fc1	2	#include "config.h"
2f47eae2 JH	3	#include "run-command.h"
	4	#include "strbuf.h"
	5	#include "gpg-interface.h"
	6	#include "sigchain.h"
4322353b	7	#include "tempfile.h"
2f47eae2 JH	8
2f47eae2 JH	9	static char *configured_signing_key;
58af57e1 HS	10	struct gpg_format {
	11	const char *name;
	12	const char *program;
	13	const char **verify_args;
	14	const char **sigs;
	15	};
	16
	17	static const char *openpgp_verify_args[] = {
	18	"--keyid-format=long",
	19	NULL
	20	};
	21	static const char *openpgp_sigs[] = {
	22	"-----BEGIN PGP SIGNATURE-----",
	23	"-----BEGIN PGP MESSAGE-----",
	24	NULL
	25	};
	26
1e7adb97 HS	27	static const char *x509_verify_args[] = {
	28	NULL
	29	};
	30	static const char *x509_sigs[] = {
	31	"-----BEGIN SIGNED MESSAGE-----",
	32	NULL
	33	};
	34
58af57e1 HS	35	static struct gpg_format gpg_format[] = {
	36	{ .name = "openpgp", .program = "gpg",
	37	.verify_args = openpgp_verify_args,
	38	.sigs = openpgp_sigs
	39	},
1e7adb97 HS	40	{ .name = "x509", .program = "gpgsm",
	41	.verify_args = x509_verify_args,
	42	.sigs = x509_sigs
	43	},
58af57e1 HS	44	};
	45
	46	static struct gpg_format *use_format = &gpg_format[0];
2f47eae2	47
58af57e1 HS	48	static struct gpg_format get_format_by_name(const char str)
	49	{
	50	int i;
	51
	52	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	53	if (!strcmp(gpg_format[i].name, str))
	54	return gpg_format + i;
	55	return NULL;
	56	}
	57
	58	static struct gpg_format get_format_by_sig(const char sig)
	59	{
	60	int i, j;
	61
	62	for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
	63	for (j = 0; gpg_format[i].sigs[j]; j++)
	64	if (starts_with(sig, gpg_format[i].sigs[j]))
	65	return gpg_format + i;
	66	return NULL;
	67	}
d7c67668	68
01e57b5d MG	69	void signature_check_clear(struct signature_check *sigc)
01e57b5d MG	70	{
88ce3ef6 ÆAB	71	FREE_AND_NULL(sigc->payload);
	72	FREE_AND_NULL(sigc->gpg_output);
	73	FREE_AND_NULL(sigc->gpg_status);
	74	FREE_AND_NULL(sigc->signer);
	75	FREE_AND_NULL(sigc->key);
01e57b5d MG	76	}
01e57b5d MG	77
a50e7ca3 JH	78	static struct {
	79	char result;
	80	const char *check;
	81	} sigcheck_gpg_status[] = {
	82	{ 'G', "\n[GNUPG:] GOODSIG " },
	83	{ 'B', "\n[GNUPG:] BADSIG " },
	84	{ 'U', "\n[GNUPG:] TRUST_NEVER" },
	85	{ 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
661a1806 MG	86	{ 'E', "\n[GNUPG:] ERRSIG "},
	87	{ 'X', "\n[GNUPG:] EXPSIG "},
	88	{ 'Y', "\n[GNUPG:] EXPKEYSIG "},
	89	{ 'R', "\n[GNUPG:] REVKEYSIG "},
a50e7ca3 JH	90	};
a50e7ca3 JH	91
fbd0f166	92	static void parse_gpg_output(struct signature_check *sigc)
a50e7ca3 JH	93	{
	94	const char *buf = sigc->gpg_status;
	95	int i;
	96
	97	/* Iterate over all search strings */
	98	for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
	99	const char found, next;
	100
	101	if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
	102	found = strstr(buf, sigcheck_gpg_status[i].check);
	103	if (!found)
	104	continue;
	105	found += strlen(sigcheck_gpg_status[i].check);
	106	}
	107	sigc->result = sigcheck_gpg_status[i].result;
	108	/* The trust messages are not followed by key/signer information */
	109	if (sigc->result != 'U') {
42149d7f HS	110	next = strchrnul(found, ' ');
42149d7f HS	111	sigc->key = xmemdupz(found, next - found);
661a1806	112	/* The ERRSIG message is not followed by signer information */
42149d7f HS	113	if (*next && sigc-> result != 'E') {
42149d7f HS	114	found = next + 1;
661a1806 MG	115	next = strchrnul(found, '\n');
	116	sigc->signer = xmemdupz(found, next - found);
	117	}
a50e7ca3 JH	118	}
	119	}
	120	}
	121
434060ec	122	int check_signature(const char payload, size_t plen, const char signature,
a4cc18f2	123	size_t slen, struct signature_check *sigc)
	124	{
	125	struct strbuf gpg_output = STRBUF_INIT;
	126	struct strbuf gpg_status = STRBUF_INIT;
	127	int status;
	128
	129	sigc->result = 'N';
	130
	131	status = verify_signed_buffer(payload, plen, signature, slen,
	132	&gpg_output, &gpg_status);
	133	if (status && !gpg_output.len)
	134	goto out;
	135	sigc->payload = xmemdupz(payload, plen);
	136	sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
	137	sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
	138	parse_gpg_output(sigc);
4e5dc9ca	139	status \|= sigc->result != 'G' && sigc->result != 'U';
a4cc18f2	140
	141	out:
	142	strbuf_release(&gpg_status);
	143	strbuf_release(&gpg_output);
434060ec	144
4e5dc9ca	145	return !!status;
a4cc18f2	146	}
a4cc18f2	147
ca194d50	148	void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
ca194d50	149	{
aeff29dd	150	const char *output = flags & GPG_VERIFY_RAW ?
	151	sigc->gpg_status : sigc->gpg_output;
	152
ca194d50	153	if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
	154	fputs(sigc->payload, stdout);
	155
aeff29dd	156	if (output)
aeff29dd	157	fputs(output, stderr);
ca194d50	158	}
ca194d50	159
e6fa6cde	160	size_t parse_signature(const char *buf, size_t size)
d7c67668	161	{
d7c67668	162	size_t len = 0;
8b44b2be JK	163	size_t match = size;
	164	while (len < size) {
	165	const char *eol;
	166
58af57e1	167	if (get_format_by_sig(buf + len))
8b44b2be JK	168	match = len;
	169
	170	eol = memchr(buf + len, '\n', size - len);
d7c67668 JH	171	len += eol ? eol - (buf + len) + 1 : size - len;
d7c67668 JH	172	}
8b44b2be	173	return match;
d7c67668 JH	174	}
d7c67668 JH	175
2f47eae2 JH	176	void set_signing_key(const char *key)
	177	{
	178	free(configured_signing_key);
	179	configured_signing_key = xstrdup(key);
	180	}
	181
	182	int git_gpg_config(const char var, const char value, void *cb)
	183	{
58af57e1 HS	184	struct gpg_format *fmt = NULL;
	185	char *fmtname = NULL;
	186
2f47eae2	187	if (!strcmp(var, "user.signingkey")) {
1b0eeec3 JK	188	if (!value)
1b0eeec3 JK	189	return config_error_nonbool(var);
0c5e70f0	190	set_signing_key(value);
1b0eeec3	191	return 0;
0c5e70f0	192	}
1b0eeec3	193
57a8dd75 HS	194	if (!strcmp(var, "gpg.format")) {
	195	if (!value)
	196	return config_error_nonbool(var);
58af57e1 HS	197	fmt = get_format_by_name(value);
58af57e1 HS	198	if (!fmt)
57a8dd75 HS	199	return error("unsupported value for %s: %s",
57a8dd75 HS	200	var, value);
58af57e1 HS	201	use_format = fmt;
58af57e1 HS	202	return 0;
57a8dd75 HS	203	}
57a8dd75 HS	204
b02f51b1	205	if (!strcmp(var, "gpg.program") \|\| !strcmp(var, "gpg.openpgp.program"))
58af57e1 HS	206	fmtname = "openpgp";
58af57e1 HS	207
1e7adb97 HS	208	if (!strcmp(var, "gpg.x509.program"))
	209	fmtname = "x509";
	210
58af57e1 HS	211	if (fmtname) {
	212	fmt = get_format_by_name(fmtname);
	213	return git_config_string(&fmt->program, var, value);
2f47eae2	214	}
1b0eeec3	215
2f47eae2 JH	216	return 0;
	217	}
	218
	219	const char *get_signing_key(void)
	220	{
	221	if (configured_signing_key)
	222	return configured_signing_key;
f9bc573f	223	return git_committer_info(IDENT_STRICT\|IDENT_NO_DATE);
2f47eae2 JH	224	}
2f47eae2 JH	225
2f47eae2 JH	226	int sign_buffer(struct strbuf buffer, struct strbuf signature, const char *signing_key)
2f47eae2 JH	227	{
d3180279	228	struct child_process gpg = CHILD_PROCESS_INIT;
0581b546	229	int ret;
2f47eae2	230	size_t i, j, bottom;
efee9553	231	struct strbuf gpg_status = STRBUF_INIT;
2f47eae2	232
aedb5dc3	233	argv_array_pushl(&gpg.args,
58af57e1	234	use_format->program,
efee9553	235	"--status-fd=2",
aedb5dc3 JK	236	"-bsau", signing_key,
aedb5dc3 JK	237	NULL);
2f47eae2	238
0581b546	239	bottom = signature->len;
2f47eae2 JH	240
	241	/*
	242	* When the username signingkey is bad, program could be terminated
	243	* because gpg exits without reading and then write gets SIGPIPE.
	244	*/
	245	sigchain_push(SIGPIPE, SIG_IGN);
0581b546	246	ret = pipe_command(&gpg, buffer->buf, buffer->len,
efee9553	247	signature, 1024, &gpg_status, 0);
2f47eae2 JH	248	sigchain_pop(SIGPIPE);
2f47eae2 JH	249
efee9553 MG	250	ret \|= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
	251	strbuf_release(&gpg_status);
	252	if (ret)
2f47eae2 JH	253	return error(_("gpg failed to sign the data"));
	254
	255	/* Strip CR from the line endings, in case we are on Windows. */
	256	for (i = j = bottom; i < signature->len; i++)
	257	if (signature->buf[i] != '\r') {
	258	if (i != j)
	259	signature->buf[j] = signature->buf[i];
	260	j++;
	261	}
	262	strbuf_setlen(signature, j);
	263
	264	return 0;
	265	}
	266
2f47eae2 JH	267	int verify_signed_buffer(const char *payload, size_t payload_size,
2f47eae2 JH	268	const char *signature, size_t signature_size,
9cc4ac8f	269	struct strbuf gpg_output, struct strbuf gpg_status)
2f47eae2	270	{
d3180279	271	struct child_process gpg = CHILD_PROCESS_INIT;
58af57e1	272	struct gpg_format *fmt;
076aa2cb JK	273	struct tempfile *temp;
076aa2cb JK	274	int ret;
b60b7566	275	struct strbuf buf = STRBUF_INIT;
2f47eae2	276
076aa2cb JK	277	temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
076aa2cb JK	278	if (!temp)
4322353b	279	return error_errno(_("could not create temporary file"));
076aa2cb JK	280	if (write_in_full(temp->fd, signature, signature_size) < 0 \|\|
076aa2cb JK	281	close_tempfile_gently(temp) < 0) {
4322353b	282	error_errno(_("failed writing detached signature to '%s'"),
076aa2cb	283	temp->filename.buf);
4322353b JK	284	delete_tempfile(&temp);
	285	return -1;
	286	}
2f47eae2	287
58af57e1 HS	288	fmt = get_format_by_sig(signature);
	289	if (!fmt)
	290	BUG("bad signature '%s'", signature);
	291
	292	argv_array_push(&gpg.args, fmt->program);
	293	argv_array_pushv(&gpg.args, fmt->verify_args);
aedb5dc3	294	argv_array_pushl(&gpg.args,
aedb5dc3	295	"--status-fd=1",
076aa2cb	296	"--verify", temp->filename.buf, "-",
aedb5dc3	297	NULL);
2f47eae2	298
c752fcc8 JK	299	if (!gpg_status)
c752fcc8 JK	300	gpg_status = &buf;
b60b7566	301
0d2b664e JK	302	sigchain_push(SIGPIPE, SIG_IGN);
	303	ret = pipe_command(&gpg, payload, payload_size,
	304	gpg_status, 0, gpg_output, 0);
d281b45d	305	sigchain_pop(SIGPIPE);
2f47eae2	306
4322353b	307	delete_tempfile(&temp);
2f47eae2	308
c752fcc8	309	ret \|= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
9cc4ac8f	310	strbuf_release(&buf); /* no matter it was used or not */
b60b7566	311
2f47eae2 JH	312	return ret;
2f47eae2 JH	313	}