gpg-interface t: extend the existing GPG tests with GPGSM
Add test cases to cover the new X509/gpgsm support. Most of them resemble existing ones. They just switch the format to x509 and set the signingkey when creating signatures. Validation of signatures does not need any configuration of git, it does need gpgsm to be configured to trust the key(-chain). Several of the testcases build on top of existing gpg testcases. The commit ships a self-signed key for committer@example.com and configures gpgsm to trust it. Signed-off-by: Henning Schild <henning.schild@siemens.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Henning Schild committed
Jul 20, 2018 at 10:28 UTC
53fc999306af60213e18b3ffd4c0347e4a88af0a
7 files changed
+178
-5
t/lib-gpg.sh
+27
-1
@@ -38,7 +38,33 @@ then
38
"$TEST_DIRECTORY"/lib-gpg/ownertrust &&
39
gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null 2>&1 \
40
--sign -u committer@example.com &&
41
- test_set_prereq GPG
41
+ test_set_prereq GPG &&
42
+ # Available key info:
43
+ # * see t/lib-gpg/gpgsm-gen-key.in
44
+ # To generate new certificate:
45
+ # * no passphrase
46
+ # gpgsm --homedir /tmp/gpghome/ \
47
+ # -o /tmp/gpgsm.crt.user \
48
+ # --generate-key \
49
+ # --batch t/lib-gpg/gpgsm-gen-key.in
50
+ # To import certificate:
51
+ # gpgsm --homedir /tmp/gpghome/ \
52
+ # --import /tmp/gpgsm.crt.user
53
+ # To export into a .p12 we can later import:
54
+ # gpgsm --homedir /tmp/gpghome/ \
55
+ # -o t/lib-gpg/gpgsm_cert.p12 \
56
+ # --export-secret-key-p12 "committer@example.com"
57
+ echo | gpgsm --homedir "${GNUPGHOME}" 2>/dev/null \
58
+ --passphrase-fd 0 --pinentry-mode loopback \
59
+ --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
60
+ gpgsm --homedir "${GNUPGHOME}" 2>/dev/null -K \
61
+ | grep fingerprint: | cut -d" " -f4 | tr -d '\n' > \
62
+ ${GNUPGHOME}/trustlist.txt &&
63
+ echo " S relax" >> ${GNUPGHOME}/trustlist.txt &&
64
+ (gpgconf --kill gpg-agent >/dev/null 2>&1 || : ) &&
65
+ echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
66
+ -u committer@example.com -o /dev/null --sign - 2>&1 &&
67
+ test_set_prereq GPGSM
68
;;
69
esac
70
fi
t/lib-gpg/gpgsm-gen-key.in
new
+8
@@ -0,0 +1,8 @@
1
+Key-Type: RSA
2
+Key-Length: 2048
3
+Key-Usage: sign
4
+Serial: random
5
+Name-DN: CN=C O Mitter, O=Example, SN=C O, GN=Mitter
6
+Name-Email: committer@example.com
7
+Not-Before: 1970-01-01 00:00:00
8
+Not-After: 3000-01-01 00:00:00
t/lib-gpg/gpgsm_cert.p12
Binary files /dev/null and b/t/lib-gpg/gpgsm_cert.p12 differ
t/t4202-log.sh
+37
@@ -1556,12 +1556,28 @@ test_expect_success GPG 'setup signed branch' '
1556
git commit -S -m signed_commit
1557
'
1558
1559
+test_expect_success GPGSM 'setup signed branch x509' '
1560
+ test_when_finished "git reset --hard && git checkout master" &&
1561
+ git checkout -b signed-x509 master &&
1562
+ echo foo >foo &&
1563
+ git add foo &&
1564
+ test_config gpg.format x509 &&
1565
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
1566
+ git commit -S -m signed_commit
1567
+'
1568
+
1569
test_expect_success GPG 'log --graph --show-signature' '
1570
git log --graph --show-signature -n1 signed >actual &&
1571
grep "^| gpg: Signature made" actual &&
1572
grep "^| gpg: Good signature" actual
1573
'
1574
1575
+test_expect_success GPGSM 'log --graph --show-signature x509' '
1576
+ git log --graph --show-signature -n1 signed-x509 >actual &&
1577
+ grep "^| gpgsm: Signature made" actual &&
1578
+ grep "^| gpgsm: Good signature" actual
1579
+'
1580
+
1581
test_expect_success GPG 'log --graph --show-signature for merged tag' '
1582
test_when_finished "git reset --hard && git checkout master" &&
1583
git checkout -b plain master &&
@@ -1581,6 +1597,27 @@ test_expect_success GPG 'log --graph --show-signature for merged tag' '
1597
grep "^| | gpg: Good signature" actual
1598
'
1599
1600
+test_expect_success GPGSM 'log --graph --show-signature for merged tag x509' '
1601
+ test_when_finished "git reset --hard && git checkout master" &&
1602
+ test_config gpg.format x509 &&
1603
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
1604
+ git checkout -b plain-x509 master &&
1605
+ echo aaa >bar &&
1606
+ git add bar &&
1607
+ git commit -m bar_commit &&
1608
+ git checkout -b tagged-x509 master &&
1609
+ echo bbb >baz &&
1610
+ git add baz &&
1611
+ git commit -m baz_commit &&
1612
+ git tag -s -m signed_tag_msg signed_tag_x509 &&
1613
+ git checkout plain-x509 &&
1614
+ git merge --no-ff -m msg signed_tag_x509 &&
1615
+ git log --graph --show-signature -n1 plain-x509 >actual &&
1616
+ grep "^|\\\ merged tag" actual &&
1617
+ grep "^| | gpgsm: Signature made" actual &&
1618
+ grep "^| | gpgsm: Good signature" actual
1619
+'
1620
+
1621
test_expect_success GPG '--no-show-signature overrides --show-signature' '
1622
git log -1 --show-signature --no-show-signature signed >actual &&
1623
! grep "^gpg:" actual
t/t5534-push-signed.sh
+59
-4
@@ -194,10 +194,12 @@ test_expect_success GPG 'fail without key and heed user.signingkey' '
194
195
EOF
196
197
- unset GIT_COMMITTER_EMAIL &&
198
- git config user.email hasnokey@nowhere.com &&
199
- test_must_fail git push --signed dst noop ff +noff &&
200
- git config user.signingkey committer@example.com &&
197
+ test_config user.email hasnokey@nowhere.com &&
198
+ (
199
+ sane_unset GIT_COMMITTER_EMAIL &&
200
+ test_must_fail git push --signed dst noop ff +noff
201
+ ) &&
202
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
203
git push --signed dst noop ff +noff &&
204
205
(
@@ -218,4 +220,57 @@ test_expect_success GPG 'fail without key and heed user.signingkey' '
220
test_cmp expect dst/push-cert-status
221
'
222
223
+test_expect_success GPGSM 'fail without key and heed user.signingkey x509' '
224
+ test_config gpg.format x509 &&
225
+ prepare_dst &&
226
+ mkdir -p dst/.git/hooks &&
227
+ git -C dst config receive.certnonceseed sekrit &&
228
+ write_script dst/.git/hooks/post-receive <<-\EOF &&
229
+ # discard the update list
230
+ cat >/dev/null
231
+ # record the push certificate
232
+ if test -n "${GIT_PUSH_CERT-}"
233
+ then
234
+ git cat-file blob $GIT_PUSH_CERT >../push-cert
235
+ fi &&
236
+
237
+ cat >../push-cert-status <<E_O_F
238
+ SIGNER=${GIT_PUSH_CERT_SIGNER-nobody}
239
+ KEY=${GIT_PUSH_CERT_KEY-nokey}
240
+ STATUS=${GIT_PUSH_CERT_STATUS-nostatus}
241
+ NONCE_STATUS=${GIT_PUSH_CERT_NONCE_STATUS-nononcestatus}
242
+ NONCE=${GIT_PUSH_CERT_NONCE-nononce}
243
+ E_O_F
244
+
245
+ EOF
246
+
247
+ test_config user.email hasnokey@nowhere.com &&
248
+ test_config user.signingkey "" &&
249
+ (
250
+ sane_unset GIT_COMMITTER_EMAIL &&
251
+ test_must_fail git push --signed dst noop ff +noff
252
+ ) &&
253
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
254
+ git push --signed dst noop ff +noff &&
255
+
256
+ (
257
+ cat <<-\EOF &&
258
+ SIGNER=/CN=C O Mitter/O=Example/SN=C O/GN=Mitter
259
+ KEY=
260
+ STATUS=G
261
+ NONCE_STATUS=OK
262
+ EOF
263
+ sed -n -e "s/^nonce /NONCE=/p" -e "/^$/q" dst/push-cert
264
+ ) >expect.in &&
265
+ key=$(cat "${GNUPGHOME}/trustlist.txt" | cut -d" " -f1 | tr -d ":") &&
266
+ sed -e "s/^KEY=/KEY=${key}/" expect.in >expect &&
267
+
268
+ noop=$(git rev-parse noop) &&
269
+ ff=$(git rev-parse ff) &&
270
+ noff=$(git rev-parse noff) &&
271
+ grep "$noop $ff refs/heads/ff" dst/push-cert &&
272
+ grep "$noop $noff refs/heads/noff" dst/push-cert &&
273
+ test_cmp expect dst/push-cert-status
274
+'
275
+
276
test_done
t/t7004-tag.sh
+13
@@ -1354,6 +1354,19 @@ test_expect_success GPG \
1354
'test_config gpg.program echo &&
1355
test_must_fail git tag -s -m tail tag-gpg-failure'
1356
1357
+# try to sign with bad user.signingkey
1358
+test_expect_success GPGSM \
1359
+ 'git tag -s fails if gpgsm is misconfigured (bad key)' \
1360
+ 'test_config user.signingkey BobTheMouse &&
1361
+ test_config gpg.format x509 &&
1362
+ test_must_fail git tag -s -m tail tag-gpg-failure'
1363
+
1364
+# try to produce invalid signature
1365
+test_expect_success GPGSM \
1366
+ 'git tag -s fails if gpgsm is misconfigured (bad signature format)' \
1367
+ 'test_config gpg.x509.program echo &&
1368
+ test_config gpg.format x509 &&
1369
+ test_must_fail git tag -s -m tail tag-gpg-failure'
1370
1371
# try to verify without gpg:
1372
t/t7030-verify-tag.sh
+34
@@ -41,6 +41,13 @@ test_expect_success GPG 'create signed tags' '
41
git tag -uB7227189 -m eighth eighth-signed-alt
42
'
43
44
+test_expect_success GPGSM 'create signed tags x509 ' '
45
+ test_config gpg.format x509 &&
46
+ test_config user.signingkey $GIT_COMMITTER_EMAIL &&
47
+ echo 9 >file && test_tick && git commit -a -m "nineth gpgsm-signed" &&
48
+ git tag -s -m nineth nineth-signed-x509
49
+'
50
+
51
test_expect_success GPG 'verify and show signatures' '
52
(
53
for tag in initial second merge fourth-signed sixth-signed seventh-signed
@@ -72,6 +79,13 @@ test_expect_success GPG 'verify and show signatures' '
79
)
80
'
81
82
+test_expect_success GPGSM 'verify and show signatures x509' '
83
+ git verify-tag nineth-signed-x509 2>actual &&
84
+ grep "Good signature from" actual &&
85
+ ! grep "BAD signature from" actual &&
86
+ echo nineth-signed-x509 OK
87
+'
88
+
89
test_expect_success GPG 'detect fudged signature' '
90
git cat-file tag seventh-signed >raw &&
91
sed -e "/^tag / s/seventh/7th forged/" raw >forged1 &&
@@ -112,6 +126,13 @@ test_expect_success GPG 'verify signatures with --raw' '
126
)
127
'
128
129
+test_expect_success GPGSM 'verify signatures with --raw x509' '
130
+ git verify-tag --raw nineth-signed-x509 2>actual &&
131
+ grep "GOODSIG" actual &&
132
+ ! grep "BADSIG" actual &&
133
+ echo nineth-signed-x509 OK
134
+'
135
+
136
test_expect_success GPG 'verify multiple tags' '
137
tags="fourth-signed sixth-signed seventh-signed" &&
138
for i in $tags
@@ -125,6 +146,19 @@ test_expect_success GPG 'verify multiple tags' '
146
test_cmp expect.stderr actual.stderr
147
'
148
149
+test_expect_success GPGSM 'verify multiple tags x509' '
150
+ tags="seventh-signed nineth-signed-x509" &&
151
+ for i in $tags
152
+ do
153
+ git verify-tag -v --raw $i || return 1
154
+ done >expect.stdout 2>expect.stderr.1 &&
155
+ grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
156
+ git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
157
+ grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
158
+ test_cmp expect.stdout actual.stdout &&
159
+ test_cmp expect.stderr actual.stderr
160
+'
161
+
162
test_expect_success GPG 'verifying tag with --format' '
163
cat >expect <<-\EOF &&
164
tagname : fourth-signed