fast-export: handle all kinds of tag signatures
Currently the handle_tag() function in "builtin/fast-export.c" searches only for "\n-----BEGIN PGP SIGNATURE-----\n" in the tag message to find a tag signature. This doesn't handle all kinds of OpenPGP signatures as some can start with "-----BEGIN PGP MESSAGE-----" too, and this doesn't handle SSH and X.509 signatures either as they use "-----BEGIN SSH SIGNATURE-----" and "-----BEGIN SIGNED MESSAGE-----" respectively. To handle all these kinds of tag signatures supported by Git, let's use the parse_signed_buffer() function to properly find signatures in tag messages. Signed-off-by: Christian Couder <chriscool@tuxfamily.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Christian Couder committed
Oct 13, 2025 at 10:48 UTC
31f375c31c645f35b83427045cfef719f2e4301b
2 files changed
+39
-4
builtin/fast-export.c
+3
-4
@@ -931,9 +931,8 @@ static void handle_tag(const char *name, struct tag *tag)
931
932
/* handle signed tags */
933
if (message) {
934
- const char *signature = strstr(message,
935
- "\n-----BEGIN PGP SIGNATURE-----\n");
936
- if (signature)
934
+ size_t sig_offset = parse_signed_buffer(message, message_size);
935
+ if (sig_offset < message_size)
936
switch (signed_tag_mode) {
937
case SIGN_ABORT:
938
die("encountered signed tag %s; use "
@@ -950,7 +949,7 @@ static void handle_tag(const char *name, struct tag *tag)
949
oid_to_hex(&tag->object.oid));
950
/* fallthru */
951
case SIGN_STRIP:
953
- message_size = signature + 1 - message;
952
+ message_size = sig_offset;
953
break;
954
}
955
}
t/t9350-fast-export.sh
+36
@@ -279,6 +279,42 @@ test_expect_success 'signed-tags=warn-strip' '
279
test -s err
280
'
281
282
+test_expect_success GPGSM 'setup X.509 signed tag' '
283
+ test_config gpg.format x509 &&
284
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
285
+
286
+ git tag -s -m "X.509 signed tag" x509-signed $(git rev-parse HEAD) &&
287
+ ANNOTATED_TAG_COUNT=$((ANNOTATED_TAG_COUNT + 1))
288
+'
289
+
290
+test_expect_success GPGSM 'signed-tags=verbatim with X.509' '
291
+ git fast-export --signed-tags=verbatim x509-signed > output &&
292
+ test_grep "SIGNED MESSAGE" output
293
+'
294
+
295
+test_expect_success GPGSM 'signed-tags=strip with X.509' '
296
+ git fast-export --signed-tags=strip x509-signed > output &&
297
+ test_grep ! "SIGNED MESSAGE" output
298
+'
299
+
300
+test_expect_success GPGSSH 'setup SSH signed tag' '
301
+ test_config gpg.format ssh &&
302
+ test_config user.signingkey "${GPGSSH_KEY_PRIMARY}" &&
303
+
304
+ git tag -s -m "SSH signed tag" ssh-signed $(git rev-parse HEAD) &&
305
+ ANNOTATED_TAG_COUNT=$((ANNOTATED_TAG_COUNT + 1))
306
+'
307
+
308
+test_expect_success GPGSSH 'signed-tags=verbatim with SSH' '
309
+ git fast-export --signed-tags=verbatim ssh-signed > output &&
310
+ test_grep "SSH SIGNATURE" output
311
+'
312
+
313
+test_expect_success GPGSSH 'signed-tags=strip with SSH' '
314
+ git fast-export --signed-tags=strip ssh-signed > output &&
315
+ test_grep ! "SSH SIGNATURE" output
316
+'
317
+
318
test_expect_success GPG 'set up signed commit' '
319
320
# Generate a commit with both "gpgsig" and "encoding" set, so