git/t/t7030-verify-tag.sh

143 lines
3.8 KiB
Bash
Raw Normal View History

#!/bin/sh
test_description='signed tag tests'
. ./test-lib.sh
. "$TEST_DIRECTORY/lib-gpg.sh"
test_expect_success GPG 'create signed tags' '
echo 1 >file && git add file &&
test_tick && git commit -m initial &&
git tag -s -m initial initial &&
git branch side &&
echo 2 >file && test_tick && git commit -a -m second &&
git tag -s -m second second &&
git checkout side &&
echo 3 >elif && git add elif &&
test_tick && git commit -m "third on side" &&
git checkout master &&
test_tick && git merge -S side &&
git tag -s -m merge merge &&
echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" &&
git tag -a -m fourth-unsigned fourth-unsigned &&
test_tick && git commit --amend -S -m "fourth signed" &&
git tag -s -m fourth fourth-signed &&
echo 5 >file && test_tick && git commit -a -m "fifth" &&
git tag fifth-unsigned &&
git config commit.gpgsign true &&
echo 6 >file && test_tick && git commit -a -m "sixth" &&
git tag -a -m sixth sixth-unsigned &&
test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ &&
git tag -m seventh -s seventh-signed &&
echo 8 >file && test_tick && git commit -a -m eighth &&
git tag -uB7227189 -m eighth eighth-signed-alt
'
test_expect_success GPG 'verify and show signatures' '
(
for tag in initial second merge fourth-signed sixth-signed seventh-signed
do
git verify-tag $tag 2>actual &&
grep "Good signature from" actual &&
! grep "BAD signature from" actual &&
echo $tag OK || exit 1
done
) &&
(
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
do
test_must_fail git verify-tag $tag 2>actual &&
! grep "Good signature from" actual &&
! grep "BAD signature from" actual &&
echo $tag OK || exit 1
done
) &&
(
for tag in eighth-signed-alt
do
git verify-tag $tag 2>actual &&
grep "Good signature from" actual &&
! grep "BAD signature from" actual &&
grep "not certified" actual &&
echo $tag OK || exit 1
done
)
'
test_expect_success GPG 'detect fudged signature' '
git cat-file tag seventh-signed >raw &&
sed -e "s/seventh/7th forged/" raw >forged1 &&
git hash-object -w -t tag forged1 >forged1.tag &&
test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&
grep "BAD signature from" actual1 &&
! grep "Good signature from" actual1
'
test_expect_success GPG 'verify signatures with --raw' '
(
for tag in initial second merge fourth-signed sixth-signed seventh-signed
do
git verify-tag --raw $tag 2>actual &&
grep "GOODSIG" actual &&
! grep "BADSIG" actual &&
echo $tag OK || exit 1
done
) &&
(
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
do
test_must_fail git verify-tag --raw $tag 2>actual &&
! grep "GOODSIG" actual &&
! grep "BADSIG" actual &&
echo $tag OK || exit 1
done
) &&
(
for tag in eighth-signed-alt
do
git verify-tag --raw $tag 2>actual &&
grep "GOODSIG" actual &&
! grep "BADSIG" actual &&
grep "TRUST_UNDEFINED" actual &&
echo $tag OK || exit 1
done
)
'
test_expect_success GPG 'verify multiple tags' '
tags="fourth-signed sixth-signed seventh-signed" &&
for i in $tags
do
git verify-tag -v --raw $i || return 1
done >expect.stdout 2>expect.stderr.1 &&
grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
test_cmp expect.stdout actual.stdout &&
test_cmp expect.stderr actual.stderr
'
t7004, t7030: fix here-doc syntax errors Jan Palus noticed that some here-doc are spelled incorrectly, resulting the entire remainder of the test snippet being slurped into the "expect" file as if it were data, e.g. in this sequence cat >expect <<EOF && ... expectation ... EOF git $cmd_being_tested >actual && test_cmp expect actual the last command of the test is "cat" that sends everything to 'expect' and succeeds. Fixing these issues in t7004 and t7030 reveals that "git tag -v" and "git verify-tag" with their --format option do not work as the test was expecting originally. Instead of showing both valid tags and tags with incorrect signatures on their output, tags that do not pass verification are omitted from the output. Another breakage that is uncovered is that these tests must be restricted to environment where gpg is available. Arguably, that is a safer behaviour, and because the format specifiers like %(tag) do not have a way to show if the signature verifies correctly, the command with the --format option cannot be used to get a list of tags annotated with their signature validity anyway. For now, let's fix the here-doc syntax, update the expectation to match the reality, and update the test prerequisite. Maybe later when we extend the --format language available to "git tag -v" and "git verify-tag" to include things like "%(gpg:status)", we may want to change the behaviour so that piping a list of tag names into xargs git verify-tag --format='%(gpg:status) %(tag)' becomes a good way to produce such a list, but that is a separate topic. Noticed-by: Jan Palus <jan.palus@gmail.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Santiago Torres <santiago@nyu.edu> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-03-23 22:28:47 +00:00
test_expect_success GPG 'verifying tag with --format' '
cat >expect <<-\EOF &&
tagname : fourth-signed
t7004, t7030: fix here-doc syntax errors Jan Palus noticed that some here-doc are spelled incorrectly, resulting the entire remainder of the test snippet being slurped into the "expect" file as if it were data, e.g. in this sequence cat >expect <<EOF && ... expectation ... EOF git $cmd_being_tested >actual && test_cmp expect actual the last command of the test is "cat" that sends everything to 'expect' and succeeds. Fixing these issues in t7004 and t7030 reveals that "git tag -v" and "git verify-tag" with their --format option do not work as the test was expecting originally. Instead of showing both valid tags and tags with incorrect signatures on their output, tags that do not pass verification are omitted from the output. Another breakage that is uncovered is that these tests must be restricted to environment where gpg is available. Arguably, that is a safer behaviour, and because the format specifiers like %(tag) do not have a way to show if the signature verifies correctly, the command with the --format option cannot be used to get a list of tags annotated with their signature validity anyway. For now, let's fix the here-doc syntax, update the expectation to match the reality, and update the test prerequisite. Maybe later when we extend the --format language available to "git tag -v" and "git verify-tag" to include things like "%(gpg:status)", we may want to change the behaviour so that piping a list of tag names into xargs git verify-tag --format='%(gpg:status) %(tag)' becomes a good way to produce such a list, but that is a separate topic. Noticed-by: Jan Palus <jan.palus@gmail.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Santiago Torres <santiago@nyu.edu> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-03-23 22:28:47 +00:00
EOF
git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual &&
test_cmp expect actual
'
t7004, t7030: fix here-doc syntax errors Jan Palus noticed that some here-doc are spelled incorrectly, resulting the entire remainder of the test snippet being slurped into the "expect" file as if it were data, e.g. in this sequence cat >expect <<EOF && ... expectation ... EOF git $cmd_being_tested >actual && test_cmp expect actual the last command of the test is "cat" that sends everything to 'expect' and succeeds. Fixing these issues in t7004 and t7030 reveals that "git tag -v" and "git verify-tag" with their --format option do not work as the test was expecting originally. Instead of showing both valid tags and tags with incorrect signatures on their output, tags that do not pass verification are omitted from the output. Another breakage that is uncovered is that these tests must be restricted to environment where gpg is available. Arguably, that is a safer behaviour, and because the format specifiers like %(tag) do not have a way to show if the signature verifies correctly, the command with the --format option cannot be used to get a list of tags annotated with their signature validity anyway. For now, let's fix the here-doc syntax, update the expectation to match the reality, and update the test prerequisite. Maybe later when we extend the --format language available to "git tag -v" and "git verify-tag" to include things like "%(gpg:status)", we may want to change the behaviour so that piping a list of tag names into xargs git verify-tag --format='%(gpg:status) %(tag)' becomes a good way to produce such a list, but that is a separate topic. Noticed-by: Jan Palus <jan.palus@gmail.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Santiago Torres <santiago@nyu.edu> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2017-03-23 22:28:47 +00:00
test_expect_success GPG 'verifying a forged tag with --format should fail silently' '
>expect &&
test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged &&
test_cmp expect actual-forged
'
test_done