ssh signing: make git log verify key lifetime
Set the payload_type for check_signature() when calling git log. Implements the same tests as for verify-commit. Signed-off-by: Fabian Stelzer <fs@gigacodes.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Fabian Stelzer committed
Dec 9, 2021 at 09:52 UTC
4bbf3780ff2c485b1d0781d58b26e01f75dffcc1
2 files changed
+45
log-tree.c
+2
@@ -513,6 +513,7 @@ static void show_signature(struct rev_info *opt, struct commit *commit)
513
if (parse_signed_commit(commit, &payload, &signature, the_hash_algo) <= 0)
514
goto out;
515
516
+ sigc.payload_type = SIGNATURE_PAYLOAD_COMMIT;
517
sigc.payload = strbuf_detach(&payload, &sigc.payload_len);
518
status = check_signature(&sigc, signature.buf, signature.len);
519
if (status && !sigc.output)
@@ -583,6 +584,7 @@ static int show_one_mergetag(struct commit *commit,
584
status = -1;
585
if (parse_signature(extra->value, extra->len, &payload, &signature)) {
586
/* could have a good signature */
587
+ sigc.payload_type = SIGNATURE_PAYLOAD_TAG;
588
sigc.payload = strbuf_detach(&payload, &sigc.payload_len);
589
status = check_signature(&sigc, signature.buf, signature.len);
590
if (sigc.output)
t/t4202-log.sh
+43
@@ -1677,6 +1677,24 @@ test_expect_success GPGSSH 'setup sshkey signed branch' '
1677
git commit -S -m signed_commit
1678
'
1679
1680
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'create signed commits with keys having defined lifetimes' '
1681
+ test_config gpg.format ssh &&
1682
+ touch file &&
1683
+ git add file &&
1684
+
1685
+ echo expired >file && test_tick && git commit -a -m expired -S"${GPGSSH_KEY_EXPIRED}" &&
1686
+ git tag expired-signed &&
1687
+
1688
+ echo notyetvalid >file && test_tick && git commit -a -m notyetvalid -S"${GPGSSH_KEY_NOTYETVALID}" &&
1689
+ git tag notyetvalid-signed &&
1690
+
1691
+ echo timeboxedvalid >file && test_tick && git commit -a -m timeboxedvalid -S"${GPGSSH_KEY_TIMEBOXEDVALID}" &&
1692
+ git tag timeboxedvalid-signed &&
1693
+
1694
+ echo timeboxedinvalid >file && test_tick && git commit -a -m timeboxedinvalid -S"${GPGSSH_KEY_TIMEBOXEDINVALID}" &&
1695
+ git tag timeboxedinvalid-signed
1696
+'
1697
+
1698
test_expect_success GPGSM 'log x509 fingerprint' '
1699
echo "F8BF62E0693D0694816377099909C779FA23FD65 | " >expect &&
1700
git log -n1 --format="%GF | %GP" signed-x509 >actual &&
@@ -1714,6 +1732,31 @@ test_expect_success GPGSSH 'log --graph --show-signature ssh' '
1732
grep "${GOOD_SIGNATURE_TRUSTED}" actual
1733
'
1734
1735
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'log shows failure on expired signature key' '
1736
+ test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
1737
+ git log --graph --show-signature -n1 expired-signed >actual &&
1738
+ ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
1739
+'
1740
+
1741
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'log shows failure on not yet valid signature key' '
1742
+ test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
1743
+ git log --graph --show-signature -n1 notyetvalid-signed >actual &&
1744
+ ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
1745
+'
1746
+
1747
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'log show success with commit date and key validity matching' '
1748
+ test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
1749
+ git log --graph --show-signature -n1 timeboxedvalid-signed >actual &&
1750
+ grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual &&
1751
+ ! grep "${GPGSSH_BAD_SIGNATURE}" actual
1752
+'
1753
+
1754
+test_expect_success GPGSSH,GPGSSH_VERIFYTIME 'log shows failure with commit date outside of key validity' '
1755
+ test_config gpg.ssh.allowedSignersFile "${GPGSSH_ALLOWED_SIGNERS}" &&
1756
+ git log --graph --show-signature -n1 timeboxedinvalid-signed >actual &&
1757
+ ! grep "${GPGSSH_GOOD_SIGNATURE_TRUSTED}" actual
1758
+'
1759
+
1760
test_expect_success GPG 'log --graph --show-signature for merged tag' '
1761
test_when_finished "git reset --hard && git checkout main" &&
1762
git checkout -b plain main &&