1#!/bin/sh
2
3test_description='signed push'
4
5. ./test-lib.sh
6. "$TEST_DIRECTORY"/lib-gpg.sh
7
8prepare_dst () {
9 rm -fr dst &&
10 test_create_repo dst &&
11
12 git push dst master:noop master:ff master:noff
13}
14
15test_expect_success setup '
16 # master, ff and noff branches pointing at the same commit
17 test_tick &&
18 git commit --allow-empty -m initial &&
19
20 git checkout -b noop &&
21 git checkout -b ff &&
22 git checkout -b noff &&
23
24 # noop stays the same, ff advances, noff rewrites
25 test_tick &&
26 git commit --allow-empty --amend -m rewritten &&
27 git checkout ff &&
28
29 test_tick &&
30 git commit --allow-empty -m second
31'
32
33test_expect_success 'unsigned push does not send push certificate' '
34 prepare_dst &&
35 mkdir -p dst/.git/hooks &&
36 write_script dst/.git/hooks/post-receive <<-\EOF &&
37 # discard the update list
38 cat >/dev/null
39 # record the push certificate
40 if test -n "${GIT_PUSH_CERT-}"
41 then
42 git cat-file blob $GIT_PUSH_CERT >../push-cert
43 fi
44 EOF
45
46 git push dst noop ff +noff &&
47 ! test -f dst/push-cert
48'
49
50test_expect_success 'talking with a receiver without push certificate support' '
51 prepare_dst &&
52 mkdir -p dst/.git/hooks &&
53 write_script dst/.git/hooks/post-receive <<-\EOF &&
54 # discard the update list
55 cat >/dev/null
56 # record the push certificate
57 if test -n "${GIT_PUSH_CERT-}"
58 then
59 git cat-file blob $GIT_PUSH_CERT >../push-cert
60 fi
61 EOF
62
63 git push dst noop ff +noff &&
64 ! test -f dst/push-cert
65'
66
67test_expect_success 'push --signed fails with a receiver without push certificate support' '
68 prepare_dst &&
69 mkdir -p dst/.git/hooks &&
70 test_must_fail git push --signed dst noop ff +noff 2>err &&
71 test_i18ngrep "the receiving end does not support" err
72'
73
74test_expect_success 'push --signed=1 is accepted' '
75 prepare_dst &&
76 mkdir -p dst/.git/hooks &&
77 test_must_fail git push --signed=1 dst noop ff +noff 2>err &&
78 test_i18ngrep "the receiving end does not support" err
79'
80
81test_expect_success GPG 'no certificate for a signed push with no update' '
82 prepare_dst &&
83 mkdir -p dst/.git/hooks &&
84 write_script dst/.git/hooks/post-receive <<-\EOF &&
85 if test -n "${GIT_PUSH_CERT-}"
86 then
87 git cat-file blob $GIT_PUSH_CERT >../push-cert
88 fi
89 EOF
90 git push dst noop &&
91 ! test -f dst/push-cert
92'
93
94test_expect_success GPG 'signed push sends push certificate' '
95 prepare_dst &&
96 mkdir -p dst/.git/hooks &&
97 git -C dst config receive.certnonceseed sekrit &&
98 write_script dst/.git/hooks/post-receive <<-\EOF &&
99 # discard the update list
100 cat >/dev/null
101 # record the push certificate
102 if test -n "${GIT_PUSH_CERT-}"
103 then
104 git cat-file blob $GIT_PUSH_CERT >../push-cert
105 fi &&
106
107 cat >../push-cert-status <<E_O_F
108 SIGNER=${GIT_PUSH_CERT_SIGNER-nobody}
109 KEY=${GIT_PUSH_CERT_KEY-nokey}
110 STATUS=${GIT_PUSH_CERT_STATUS-nostatus}
111 NONCE_STATUS=${GIT_PUSH_CERT_NONCE_STATUS-nononcestatus}
112 NONCE=${GIT_PUSH_CERT_NONCE-nononce}
113 E_O_F
114
115 EOF
116
117 git push --signed dst noop ff +noff &&
118
119 (
120 cat <<-\EOF &&
121 SIGNER=C O Mitter <committer@example.com>
122 KEY=13B6F51ECDDE430D
123 STATUS=G
124 NONCE_STATUS=OK
125 EOF
126 sed -n -e "s/^nonce /NONCE=/p" -e "/^$/q" dst/push-cert
127 ) >expect &&
128
129 grep "$(git rev-parse noop ff) refs/heads/ff" dst/push-cert &&
130 grep "$(git rev-parse noop noff) refs/heads/noff" dst/push-cert &&
131 test_cmp expect dst/push-cert-status
132'
133
134test_expect_success GPG 'fail without key and heed user.signingkey' '
135 prepare_dst &&
136 mkdir -p dst/.git/hooks &&
137 git -C dst config receive.certnonceseed sekrit &&
138 write_script dst/.git/hooks/post-receive <<-\EOF &&
139 # discard the update list
140 cat >/dev/null
141 # record the push certificate
142 if test -n "${GIT_PUSH_CERT-}"
143 then
144 git cat-file blob $GIT_PUSH_CERT >../push-cert
145 fi &&
146
147 cat >../push-cert-status <<E_O_F
148 SIGNER=${GIT_PUSH_CERT_SIGNER-nobody}
149 KEY=${GIT_PUSH_CERT_KEY-nokey}
150 STATUS=${GIT_PUSH_CERT_STATUS-nostatus}
151 NONCE_STATUS=${GIT_PUSH_CERT_NONCE_STATUS-nononcestatus}
152 NONCE=${GIT_PUSH_CERT_NONCE-nononce}
153 E_O_F
154
155 EOF
156
157 unset GIT_COMMITTER_EMAIL &&
158 git config user.email hasnokey@nowhere.com &&
159 test_must_fail git push --signed dst noop ff +noff &&
160 git config user.signingkey committer@example.com &&
161 git push --signed dst noop ff +noff &&
162
163 (
164 cat <<-\EOF &&
165 SIGNER=C O Mitter <committer@example.com>
166 KEY=13B6F51ECDDE430D
167 STATUS=G
168 NONCE_STATUS=OK
169 EOF
170 sed -n -e "s/^nonce /NONCE=/p" -e "/^$/q" dst/push-cert
171 ) >expect &&
172
173 grep "$(git rev-parse noop ff) refs/heads/ff" dst/push-cert &&
174 grep "$(git rev-parse noop noff) refs/heads/noff" dst/push-cert &&
175 test_cmp expect dst/push-cert-status
176'
177
178test_done