ssh signing: return an error when signature cannot be read
If the signature file cannot be read we print an error message but do not return an error to the caller. In practice it seems unlikely that the file would be unreadable if the call to ssh-keygen succeeds. The unlink_or_warn() call is moved to the end of the function so that we always try and remove the signature file. This isn't strictly necessary at the moment but it protects us against any extra code being added between trying to read the signature file and the cleanup at the end of the function in the future. unlink_or_warn() only prints a warning if it exists and cannot be removed. Signed-off-by: Phillip Wood <phillip.wood@dunelm.org.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Phillip Wood committed
Oct 4, 2022 at 10:01 UTC
36fb0d07d83df475bc6b716795b2111f8408cbcf
1 file changed
+4
-3
gpg-interface.c
+4
-3
@@ -1043,12 +1043,11 @@ static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
1043
strbuf_addbuf(&ssh_signature_filename, &buffer_file->filename);
1044
strbuf_addstr(&ssh_signature_filename, ".sig");
1045
if (strbuf_read_file(signature, ssh_signature_filename.buf, 0) < 0) {
1046
- error_errno(
1046
+ ret = error_errno(
1047
_("failed reading ssh signing data buffer from '%s'"),
1048
ssh_signature_filename.buf);
1049
+ goto out;
1050
}
1050
- unlink_or_warn(ssh_signature_filename.buf);
1051
-
1051
/* Strip CR from the line endings, in case we are on Windows. */
1052
remove_cr_after(signature, bottom);
1053
@@ -1057,6 +1056,8 @@ out:
1056
delete_tempfile(&key_file);
1057
if (buffer_file)
1058
delete_tempfile(&buffer_file);
1059
+ if (ssh_signature_filename.len)
1060
+ unlink_or_warn(ssh_signature_filename.buf);
1061
strbuf_release(&signer_stderr);
1062
strbuf_release(&ssh_signature_filename);
1063
FREE_AND_NULL(ssh_signing_key_file);