mirror of
https://github.com/git/git
synced 2024-08-25 02:35:46 +00:00
![Hans Jerry Illikainen](/assets/img/avatar_default.png)
Previously, signature verification for merge and pull operations checked
if the key had a trust-level of either TRUST_NEVER or TRUST_UNDEFINED in
verify_merge_signature(). If that was the case, the process die()d.
The other code paths that did signature verification relied entirely on
the return code from check_commit_signature(). And signatures made with
a good key, irregardless of its trust level, was considered valid by
check_commit_signature().
This difference in behavior might induce users to erroneously assume
that the trust level of a key in their keyring is always considered by
Git, even for operations where it is not (e.g. during a verify-commit or
verify-tag).
The way it worked was by gpg-interface.c storing the result from the
key/signature status *and* the lowest-two trust levels in the `result`
member of the signature_check structure (the last of these status lines
that were encountered got written to `result`). These are documented in
GPG under the subsection `General status codes` and `Key related`,
respectively [1].
The GPG documentation says the following on the TRUST_ status codes [1]:
"""
These are several similar status codes:
- TRUST_UNDEFINED <error_token>
- TRUST_NEVER <error_token>
- TRUST_MARGINAL [0 [<validation_model>]]
- TRUST_FULLY [0 [<validation_model>]]
- TRUST_ULTIMATE [0 [<validation_model>]]
For good signatures one of these status lines are emitted to
indicate the validity of the key used to create the signature.
The error token values are currently only emitted by gpgsm.
"""
My interpretation is that the trust level is conceptionally different
from the validity of the key and/or signature. That seems to also have
been the assumption of the old code in check_signature() where a result
of 'G' (as in GOODSIG) and 'U' (as in TRUST_NEVER or TRUST_UNDEFINED)
were both considered a success.
The two cases where a result of 'U' had special meaning were in
verify_merge_signature() (where this caused git to die()) and in
format_commit_one() (where it affected the output of the %G? format
specifier).
I think it makes sense to refactor the processing of TRUST_ status lines
such that users can configure a minimum trust level that is enforced
globally, rather than have individual parts of git (e.g. merge) do it
themselves (except for a grace period with backward compatibility).
I also think it makes sense to not store the trust level in the same
struct member as the key/signature status. While the presence of a
TRUST_ status code does imply that the signature is good (see the first
paragraph in the included snippet above), as far as I can tell, the
order of the status lines from GPG isn't well-defined; thus it would
seem plausible that the trust level could be overwritten with the
key/signature status if they were stored in the same member of the
signature_check structure.
This patch introduces a new configuration option: gpg.minTrustLevel. It
consolidates trust-level verification to gpg-interface.c and adds a new
`trust_level` member to the signature_check structure.
Backward-compatibility is maintained by introducing a special case in
verify_merge_signature() such that if no user-configurable
gpg.minTrustLevel is set, then the old behavior of rejecting
TRUST_UNDEFINED and TRUST_NEVER is enforced. If, on the other hand,
gpg.minTrustLevel is set, then that value overrides the old behavior.
Similarly, the %G? format specifier will continue show 'U' for
signatures made with a key that has a trust level of TRUST_UNDEFINED or
TRUST_NEVER, even though the 'U' character no longer exist in the
`result` member of the signature_check structure. A new format
specifier, %GT, is also introduced for users that want to show all
possible trust levels for a signature.
Another approach would have been to simply drop the trust-level
requirement in verify_merge_signature(). This would also have made the
behavior consistent with other parts of git that perform signature
verification. However, requiring a minimum trust level for signing keys
does seem to have a real-world use-case. For example, the build system
used by the Qubes OS project currently parses the raw output from
verify-tag in order to assert a minimum trust level for keys used to
sign git tags [2].
[1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/doc/DETAILS;h=bd00006e933ac56719b1edd2478ecd79273eae72;hb=refs/heads/master
[2] 9674c1991d/scripts/verify-git-tag (L43)
Signed-off-by: Hans Jerry Illikainen <hji@dyntopia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
200 lines
5.8 KiB
Bash
Executable file
200 lines
5.8 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='signed tag tests'
|
|
. ./test-lib.sh
|
|
. "$TEST_DIRECTORY/lib-gpg.sh"
|
|
|
|
test_expect_success GPG 'create signed tags' '
|
|
echo 1 >file && git add file &&
|
|
test_tick && git commit -m initial &&
|
|
git tag -s -m initial initial &&
|
|
git branch side &&
|
|
|
|
echo 2 >file && test_tick && git commit -a -m second &&
|
|
git tag -s -m second second &&
|
|
|
|
git checkout side &&
|
|
echo 3 >elif && git add elif &&
|
|
test_tick && git commit -m "third on side" &&
|
|
|
|
git checkout master &&
|
|
test_tick && git merge -S side &&
|
|
git tag -s -m merge merge &&
|
|
|
|
echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" &&
|
|
git tag -a -m fourth-unsigned fourth-unsigned &&
|
|
|
|
test_tick && git commit --amend -S -m "fourth signed" &&
|
|
git tag -s -m fourth fourth-signed &&
|
|
|
|
echo 5 >file && test_tick && git commit -a -m "fifth" &&
|
|
git tag fifth-unsigned &&
|
|
|
|
git config commit.gpgsign true &&
|
|
echo 6 >file && test_tick && git commit -a -m "sixth" &&
|
|
git tag -a -m sixth sixth-unsigned &&
|
|
|
|
test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ &&
|
|
git tag -m seventh -s seventh-signed &&
|
|
|
|
echo 8 >file && test_tick && git commit -a -m eighth &&
|
|
git tag -uB7227189 -m eighth eighth-signed-alt
|
|
'
|
|
|
|
test_expect_success GPGSM 'create signed tags x509 ' '
|
|
test_config gpg.format x509 &&
|
|
test_config user.signingkey $GIT_COMMITTER_EMAIL &&
|
|
echo 9 >file && test_tick && git commit -a -m "ninth gpgsm-signed" &&
|
|
git tag -s -m ninth ninth-signed-x509
|
|
'
|
|
|
|
test_expect_success GPG 'verify and show signatures' '
|
|
(
|
|
for tag in initial second merge fourth-signed sixth-signed seventh-signed
|
|
do
|
|
git verify-tag $tag 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
|
|
do
|
|
test_must_fail git verify-tag $tag 2>actual &&
|
|
! grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in eighth-signed-alt
|
|
do
|
|
git verify-tag $tag 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
grep "not certified" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
)
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify and show signatures x509' '
|
|
git verify-tag ninth-signed-x509 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo ninth-signed-x509 OK
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify and show signatures x509 with low minTrustLevel' '
|
|
test_config gpg.minTrustLevel undefined &&
|
|
git verify-tag ninth-signed-x509 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo ninth-signed-x509 OK
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify and show signatures x509 with matching minTrustLevel' '
|
|
test_config gpg.minTrustLevel fully &&
|
|
git verify-tag ninth-signed-x509 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo ninth-signed-x509 OK
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify and show signatures x509 with high minTrustLevel' '
|
|
test_config gpg.minTrustLevel ultimate &&
|
|
test_must_fail git verify-tag ninth-signed-x509 2>actual &&
|
|
grep "Good signature from" actual &&
|
|
! grep "BAD signature from" actual &&
|
|
echo ninth-signed-x509 OK
|
|
'
|
|
|
|
test_expect_success GPG 'detect fudged signature' '
|
|
git cat-file tag seventh-signed >raw &&
|
|
sed -e "/^tag / s/seventh/7th forged/" raw >forged1 &&
|
|
git hash-object -w -t tag forged1 >forged1.tag &&
|
|
test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&
|
|
grep "BAD signature from" actual1 &&
|
|
! grep "Good signature from" actual1
|
|
'
|
|
|
|
test_expect_success GPG 'verify signatures with --raw' '
|
|
(
|
|
for tag in initial second merge fourth-signed sixth-signed seventh-signed
|
|
do
|
|
git verify-tag --raw $tag 2>actual &&
|
|
grep "GOODSIG" actual &&
|
|
! grep "BADSIG" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in fourth-unsigned fifth-unsigned sixth-unsigned
|
|
do
|
|
test_must_fail git verify-tag --raw $tag 2>actual &&
|
|
! grep "GOODSIG" actual &&
|
|
! grep "BADSIG" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
) &&
|
|
(
|
|
for tag in eighth-signed-alt
|
|
do
|
|
git verify-tag --raw $tag 2>actual &&
|
|
grep "GOODSIG" actual &&
|
|
! grep "BADSIG" actual &&
|
|
grep "TRUST_UNDEFINED" actual &&
|
|
echo $tag OK || exit 1
|
|
done
|
|
)
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify signatures with --raw x509' '
|
|
git verify-tag --raw ninth-signed-x509 2>actual &&
|
|
grep "GOODSIG" actual &&
|
|
! grep "BADSIG" actual &&
|
|
echo ninth-signed-x509 OK
|
|
'
|
|
|
|
test_expect_success GPG 'verify multiple tags' '
|
|
tags="fourth-signed sixth-signed seventh-signed" &&
|
|
for i in $tags
|
|
do
|
|
git verify-tag -v --raw $i || return 1
|
|
done >expect.stdout 2>expect.stderr.1 &&
|
|
grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
|
|
git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
|
|
grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
|
|
test_cmp expect.stdout actual.stdout &&
|
|
test_cmp expect.stderr actual.stderr
|
|
'
|
|
|
|
test_expect_success GPGSM 'verify multiple tags x509' '
|
|
tags="seventh-signed ninth-signed-x509" &&
|
|
for i in $tags
|
|
do
|
|
git verify-tag -v --raw $i || return 1
|
|
done >expect.stdout 2>expect.stderr.1 &&
|
|
grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
|
|
git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
|
|
grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
|
|
test_cmp expect.stdout actual.stdout &&
|
|
test_cmp expect.stderr actual.stderr
|
|
'
|
|
|
|
test_expect_success GPG 'verifying tag with --format' '
|
|
cat >expect <<-\EOF &&
|
|
tagname : fourth-signed
|
|
EOF
|
|
git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual &&
|
|
test_cmp expect actual
|
|
'
|
|
|
|
test_expect_success GPG 'verifying a forged tag with --format should fail silently' '
|
|
test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged &&
|
|
test_must_be_empty actual-forged
|
|
'
|
|
|
|
test_done
|