t/t7612-merge-verify-signatures.sh

   1 #!/bin/sh
   2
   3 test_description='merge signature verification tests'
   4 . ./test-lib.sh
   5 . "$TEST_DIRECTORY/lib-gpg.sh"
   6
   7 test_expect_success GPG 'create signed commits' '
   8         echo 1 >file && git add file &&
   9         test_tick && git commit -m initial &&
  10         git tag initial &&
  11
  12         git checkout -b side-signed &&
  13         echo 3 >elif && git add elif &&
  14         test_tick && git commit -S -m "signed on side" &&
  15         git checkout initial &&
  16
  17         git checkout -b side-unsigned &&
  18         echo 3 >foo && git add foo &&
  19         test_tick && git commit -m "unsigned on side" &&
  20         git checkout initial &&
  21
  22         git checkout -b side-bad &&
  23         echo 3 >bar && git add bar &&
  24         test_tick && git commit -S -m "bad on side" &&
  25         git cat-file commit side-bad >raw &&
  26         sed -e "s/^bad/forged bad/" raw >forged &&
  27         git hash-object -w -t commit forged >forged.commit &&
  28         git checkout initial &&
  29
  30         git checkout -b side-untrusted &&
  31         echo 3 >baz && git add baz &&
  32         test_tick && git commit -SB7227189 -m "untrusted on side" &&
  33
  34         git checkout master
  35 '
  36
  37 test_expect_success GPG 'merge unsigned commit with verification' '
  38         test_when_finished "git reset --hard && git checkout initial" &&
  39         test_must_fail git merge --ff-only --verify-signatures side-unsigned 2>mergeerror &&
  40         test_i18ngrep "does not have a GPG signature" mergeerror
  41 '
  42
  43 test_expect_success GPG 'merge unsigned commit with merge.verifySignatures=true' '
  44         test_when_finished "git reset --hard && git checkout initial" &&
  45         test_config merge.verifySignatures true &&
  46         test_must_fail git merge --ff-only side-unsigned 2>mergeerror &&
  47         test_i18ngrep "does not have a GPG signature" mergeerror
  48 '
  49
  50 test_expect_success GPG 'merge commit with bad signature with verification' '
  51         test_when_finished "git reset --hard && git checkout initial" &&
  52         test_must_fail git merge --ff-only --verify-signatures $(cat forged.commit) 2>mergeerror &&
  53         test_i18ngrep "has a bad GPG signature" mergeerror
  54 '
  55
  56 test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true' '
  57         test_when_finished "git reset --hard && git checkout initial" &&
  58         test_config merge.verifySignatures true &&
  59         test_must_fail git merge --ff-only $(cat forged.commit) 2>mergeerror &&
  60         test_i18ngrep "has a bad GPG signature" mergeerror
  61 '
  62
  63 test_expect_success GPG 'merge commit with untrusted signature with verification' '
  64         test_when_finished "git reset --hard && git checkout initial" &&
  65         test_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&
  66         test_i18ngrep "has an untrusted GPG signature" mergeerror
  67 '
  68
  69 test_expect_success GPG 'merge commit with untrusted signature with merge.verifySignatures=true' '
  70         test_when_finished "git reset --hard && git checkout initial" &&
  71         test_config merge.verifySignatures true &&
  72         test_must_fail git merge --ff-only side-untrusted 2>mergeerror &&
  73         test_i18ngrep "has an untrusted GPG signature" mergeerror
  74 '
  75
  76 test_expect_success GPG 'merge signed commit with verification' '
  77         test_when_finished "git reset --hard && git checkout initial" &&
  78         git merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&
  79         test_i18ngrep "has a good GPG signature" mergeoutput
  80 '
  81
  82 test_expect_success GPG 'merge signed commit with merge.verifySignatures=true' '
  83         test_when_finished "git reset --hard && git checkout initial" &&
  84         test_config merge.verifySignatures true &&
  85         git merge --verbose --ff-only side-signed >mergeoutput &&
  86         test_i18ngrep "has a good GPG signature" mergeoutput
  87 '
  88
  89 test_expect_success GPG 'merge commit with bad signature without verification' '
  90         test_when_finished "git reset --hard && git checkout initial" &&
  91         git merge $(cat forged.commit)
  92 '
  93
  94 test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=false' '
  95         test_when_finished "git reset --hard && git checkout initial" &&
  96         test_config merge.verifySignatures false &&
  97         git merge $(cat forged.commit)
  98 '
  99
 100 test_expect_success GPG 'merge commit with bad signature with merge.verifySignatures=true and --no-verify-signatures' '
 101         test_when_finished "git reset --hard && git checkout initial" &&
 102         test_config merge.verifySignatures true &&
 103         git merge --no-verify-signatures $(cat forged.commit)
 104 '
 105
 106 test_expect_success GPG 'merge unsigned commit into unborn branch' '
 107         test_when_finished "git checkout initial" &&
 108         git checkout --orphan unborn &&
 109         test_must_fail git merge --verify-signatures side-unsigned 2>mergeerror &&
 110         test_i18ngrep "does not have a GPG signature" mergeerror
 111 '
 112
 113 test_done