ssh signing: test that gpg fails for unknown keys
Test that verify-commit/tag will fail when a gpg key is completely unknown. To do this we have to generate a key, use it for a signature and delete it from our keyring aferwards completely. Signed-off-by: Fabian Stelzer <fs@gigacodes.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Fabian Stelzer committed
Sep 10, 2021 at 20:07 UTC
1bfb57f642d34dc4b65be3602bb429abd9f32b58
1 file changed
+28
-1
t/t7510-signed-commit.sh
+28
-1
@@ -71,7 +71,25 @@ test_expect_success GPG 'create signed commits' '
71
git tag eleventh-signed $(cat oid) &&
72
echo 12 | git commit-tree --gpg-sign=B7227189 HEAD^{tree} >oid &&
73
test_line_count = 1 oid &&
74
- git tag twelfth-signed-alt $(cat oid)
74
+ git tag twelfth-signed-alt $(cat oid) &&
75
+
76
+ cat >keydetails <<-\EOF &&
77
+ Key-Type: RSA
78
+ Key-Length: 2048
79
+ Subkey-Type: RSA
80
+ Subkey-Length: 2048
81
+ Name-Real: Unknown User
82
+ Name-Email: unknown@git.com
83
+ Expire-Date: 0
84
+ %no-ask-passphrase
85
+ %no-protection
86
+ EOF
87
+ gpg --batch --gen-key keydetails &&
88
+ echo 13 >file && git commit -a -S"unknown@git.com" -m thirteenth &&
89
+ git tag thirteenth-signed &&
90
+ DELETE_FINGERPRINT=$(gpg -K --with-colons --fingerprint --batch unknown@git.com | grep "^fpr" | head -n 1 | awk -F ":" "{print \$10;}") &&
91
+ gpg --batch --yes --delete-secret-keys $DELETE_FINGERPRINT &&
92
+ gpg --batch --yes --delete-keys unknown@git.com
93
'
94
95
test_expect_success GPG 'verify and show signatures' '
@@ -110,6 +128,13 @@ test_expect_success GPG 'verify and show signatures' '
128
)
129
'
130
131
+test_expect_success GPG 'verify-commit exits failure on unknown signature' '
132
+ test_must_fail git verify-commit thirteenth-signed 2>actual &&
133
+ ! grep "Good signature from" actual &&
134
+ ! grep "BAD signature from" actual &&
135
+ grep -q -F -e "No public key" -e "public key not found" actual
136
+'
137
+
138
test_expect_success GPG 'verify-commit exits success on untrusted signature' '
139
git verify-commit eighth-signed-alt 2>actual &&
140
grep "Good signature from" actual &&
@@ -338,6 +363,8 @@ test_expect_success GPG 'show double signature with custom format' '
363
'
364
365
366
+# NEEDSWORK: This test relies on the test_tick commit/author dates from the first
367
+# 'create signed commits' test even though it creates its own
368
test_expect_success GPG 'verify-commit verifies multiply signed commits' '
369
git init multiply-signed &&
370
cd multiply-signed &&