Andrew's git - gitweb.git/blob - t/t7510-signed-commit.sh

   1#!/bin/sh
   2
   3test_description='signed commit tests'
   4. ./test-lib.sh
   5GNUPGHOME_NOT_USED=$GNUPGHOME
   6. "$TEST_DIRECTORY/lib-gpg.sh"
   7
   8test_expect_success GPG 'create signed commits' '
   9        test_when_finished "test_unconfig commit.gpgsign" &&
  10
  11        echo 1 >file && git add file &&
  12        test_tick && git commit -S -m initial &&
  13        git tag initial &&
  14        git branch side &&
  15
  16        echo 2 >file && test_tick && git commit -a -S -m second &&
  17        git tag second &&
  18
  19        git checkout side &&
  20        echo 3 >elif && git add elif &&
  21        test_tick && git commit -m "third on side" &&
  22
  23        git checkout master &&
  24        test_tick && git merge -S side &&
  25        git tag merge &&
  26
  27        echo 4 >file && test_tick && git commit -a -m "fourth unsigned" &&
  28        git tag fourth-unsigned &&
  29
  30        test_tick && git commit --amend -S -m "fourth signed" &&
  31        git tag fourth-signed &&
  32
  33        git config commit.gpgsign true &&
  34        echo 5 >file && test_tick && git commit -a -m "fifth signed" &&
  35        git tag fifth-signed &&
  36
  37        git config commit.gpgsign false &&
  38        echo 6 >file && test_tick && git commit -a -m "sixth" &&
  39        git tag sixth-unsigned &&
  40
  41        git config commit.gpgsign true &&
  42        echo 7 >file && test_tick && git commit -a -m "seventh" --no-gpg-sign &&
  43        git tag seventh-unsigned &&
  44
  45        test_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&
  46        git tag seventh-signed &&
  47
  48        echo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&
  49        git tag eighth-signed-alt &&
  50
  51        # commit.gpgsign is still on but this must not be signed
  52        git tag ninth-unsigned $(echo 9 | git commit-tree HEAD^{tree}) &&
  53        # explicit -S of course must sign.
  54        git tag tenth-signed $(echo 9 | git commit-tree -S HEAD^{tree})
  55'
  56
  57test_expect_success GPG 'verify and show signatures' '
  58        (
  59                for commit in initial second merge fourth-signed \
  60                        fifth-signed sixth-signed seventh-signed tenth-signed
  61                do
  62                        git verify-commit $commit &&
  63                        git show --pretty=short --show-signature $commit >actual &&
  64                        grep "Good signature from" actual &&
  65                        ! grep "BAD signature from" actual &&
  66                        echo $commit OK || exit 1
  67                done
  68        ) &&
  69        (
  70                for commit in merge^2 fourth-unsigned sixth-unsigned \
  71                        seventh-unsigned ninth-unsigned
  72                do
  73                        test_must_fail git verify-commit $commit &&
  74                        git show --pretty=short --show-signature $commit >actual &&
  75                        ! grep "Good signature from" actual &&
  76                        ! grep "BAD signature from" actual &&
  77                        echo $commit OK || exit 1
  78                done
  79        ) &&
  80        (
  81                for commit in eighth-signed-alt
  82                do
  83                        git show --pretty=short --show-signature $commit >actual &&
  84                        grep "Good signature from" actual &&
  85                        ! grep "BAD signature from" actual &&
  86                        grep "not certified" actual &&
  87                        echo $commit OK || exit 1
  88                done
  89        )
  90'
  91
  92test_expect_success GPG 'verify-commit exits success on untrusted signature' '
  93        git verify-commit eighth-signed-alt 2>actual &&
  94        grep "Good signature from" actual &&
  95        ! grep "BAD signature from" actual &&
  96        grep "not certified" actual
  97'
  98
  99test_expect_success GPG 'verify signatures with --raw' '
 100        (
 101                for commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed
 102                do
 103                        git verify-commit --raw $commit 2>actual &&
 104                        grep "GOODSIG" actual &&
 105                        ! grep "BADSIG" actual &&
 106                        echo $commit OK || exit 1
 107                done
 108        ) &&
 109        (
 110                for commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned
 111                do
 112                        test_must_fail git verify-commit --raw $commit 2>actual &&
 113                        ! grep "GOODSIG" actual &&
 114                        ! grep "BADSIG" actual &&
 115                        echo $commit OK || exit 1
 116                done
 117        ) &&
 118        (
 119                for commit in eighth-signed-alt
 120                do
 121                        git verify-commit --raw $commit 2>actual &&
 122                        grep "GOODSIG" actual &&
 123                        ! grep "BADSIG" actual &&
 124                        grep "TRUST_UNDEFINED" actual &&
 125                        echo $commit OK || exit 1
 126                done
 127        )
 128'
 129
 130test_expect_success GPG 'show signed commit with signature' '
 131        git show -s initial >commit &&
 132        git show -s --show-signature initial >show &&
 133        git verify-commit -v initial >verify.1 2>verify.2 &&
 134        git cat-file commit initial >cat &&
 135        grep -v -e "gpg: " -e "Warning: " show >show.commit &&
 136        grep -e "gpg: " -e "Warning: " show >show.gpg &&
 137        grep -v "^ " cat | grep -v "^gpgsig " >cat.commit &&
 138        test_cmp show.commit commit &&
 139        test_cmp show.gpg verify.2 &&
 140        test_cmp cat.commit verify.1
 141'
 142
 143test_expect_success GPG 'detect fudged signature' '
 144        git cat-file commit seventh-signed >raw &&
 145        sed -e "s/^seventh/7th forged/" raw >forged1 &&
 146        git hash-object -w -t commit forged1 >forged1.commit &&
 147        test_must_fail git verify-commit $(cat forged1.commit) &&
 148        git show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&
 149        grep "BAD signature from" actual1 &&
 150        ! grep "Good signature from" actual1
 151'
 152
 153test_expect_success GPG 'detect fudged signature with NUL' '
 154        git cat-file commit seventh-signed >raw &&
 155        cat raw >forged2 &&
 156        echo Qwik | tr "Q" "\000" >>forged2 &&
 157        git hash-object -w -t commit forged2 >forged2.commit &&
 158        test_must_fail git verify-commit $(cat forged2.commit) &&
 159        git show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&
 160        grep "BAD signature from" actual2 &&
 161        ! grep "Good signature from" actual2
 162'
 163
 164test_expect_success GPG 'amending already signed commit' '
 165        git checkout fourth-signed^0 &&
 166        git commit --amend -S --no-edit &&
 167        git verify-commit HEAD &&
 168        git show -s --show-signature HEAD >actual &&
 169        grep "Good signature from" actual &&
 170        ! grep "BAD signature from" actual
 171'
 172
 173test_expect_success GPG 'show good signature with custom format' '
 174        cat >expect <<-\EOF &&
 175        G
 176        13B6F51ECDDE430D
 177        C O Mitter <committer@example.com>
 178        EOF
 179        git log -1 --format="%G?%n%GK%n%GS" sixth-signed >actual &&
 180        test_cmp expect actual
 181'
 182
 183test_expect_success GPG 'show bad signature with custom format' '
 184        cat >expect <<-\EOF &&
 185        B
 186        13B6F51ECDDE430D
 187        C O Mitter <committer@example.com>
 188        EOF
 189        git log -1 --format="%G?%n%GK%n%GS" $(cat forged1.commit) >actual &&
 190        test_cmp expect actual
 191'
 192
 193test_expect_success GPG 'show untrusted signature with custom format' '
 194        cat >expect <<-\EOF &&
 195        U
 196        61092E85B7227189
 197        Eris Discordia <discord@example.net>
 198        EOF
 199        git log -1 --format="%G?%n%GK%n%GS" eighth-signed-alt >actual &&
 200        test_cmp expect actual
 201'
 202
 203test_expect_success GPG 'show unknown signature with custom format' '
 204        cat >expect <<-\EOF &&
 205        E
 206        61092E85B7227189
 207
 208        EOF
 209        GNUPGHOME="$GNUPGHOME_NOT_USED" git log -1 --format="%G?%n%GK%n%GS" eighth-signed-alt >actual &&
 210        test_cmp expect actual
 211'
 212
 213test_expect_success GPG 'show lack of signature with custom format' '
 214        cat >expect <<-\EOF &&
 215        N
 216
 217
 218        EOF
 219        git log -1 --format="%G?%n%GK%n%GS" seventh-unsigned >actual &&
 220        test_cmp expect actual
 221'
 222
 223test_expect_success GPG 'log.showsignature behaves like --show-signature' '
 224        test_config log.showsignature true &&
 225        git show initial >actual &&
 226        grep "gpg: Signature made" actual &&
 227        grep "gpg: Good signature" actual
 228'
 229
 230test_done