mirror of
https://github.com/git/git.git
synced 2024-10-31 14:27:54 +01:00
2f3cbcd8c5
A couple of test scripts create forged GPG signed commits or tags to check that such forgery can't fool various git commands' signature verification. All but one of those test scripts are prone to occasional failures because the forgery creates a bogus GPG signature, and git commands error out with an unexpected error message, e.g. "Commit deadbeef does not have a GPG signature" instead of "... has a bad GPG signature". 't5573-pull-verify-signatures.sh', 't7510-signed-commit.sh' and 't7612-merge-verify-signatures.sh' create forged signed commits like this: git commit -S -m "bad on side" && git cat-file commit side-bad >raw && sed -e "s/bad/forged bad/" raw >forged && git hash-object -w -t commit forged >forged.commit On rare occasions the given pattern occurs not only in the commit message but in the GPG signature as well, and after it's replaced in the signature the resulting signature becomes invalid, GPG will report CRC error and that it couldn't find any signature, which will then ultimately cause the test failure. Since in all three cases the pattern to be replaced during the forgery is the first word of the commit message's subject line, and since the GPG signature in the commit object is indented by a space, let's just anchor those patterns to the beginning of the line to prevent this issue. The test script 't7030-verify-tag.sh' creates a forged signed tag object in a similar way by replacing the pattern "seventh", but the GPG signature in tag objects is not indented by a space, so the above solution is not applicable in this case. However, in the tag object in question the pattern "seventh" occurs not only in the tag message but in the 'tag' header as well. To create a forged tag object it's sufficient to replace only one of the two occurences, so modify the sed script to limit the pattern to the 'tag' header (i.e. a line beginning with "tag ", which, because of the space character, can never occur in the base64-encoded GPG signature). Note that the forgery in 't7004-tag.sh' is not affected by this issue: while 't7004' does create a forged signed tag kind of the same way, it replaces "signed-tag" in the tag object, which, because of the '-' character, can never occur in the base64-encoded GPG signarute. Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
81 lines
2.5 KiB
Bash
Executable file
81 lines
2.5 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='pull signature verification tests'
|
|
. ./test-lib.sh
|
|
. "$TEST_DIRECTORY/lib-gpg.sh"
|
|
|
|
test_expect_success GPG 'create repositories with signed commits' '
|
|
echo 1 >a && git add a &&
|
|
test_tick && git commit -m initial &&
|
|
git tag initial &&
|
|
|
|
git clone . signed &&
|
|
(
|
|
cd signed &&
|
|
echo 2 >b && git add b &&
|
|
test_tick && git commit -S -m "signed"
|
|
) &&
|
|
|
|
git clone . unsigned &&
|
|
(
|
|
cd unsigned &&
|
|
echo 3 >c && git add c &&
|
|
test_tick && git commit -m "unsigned"
|
|
) &&
|
|
|
|
git clone . bad &&
|
|
(
|
|
cd bad &&
|
|
echo 4 >d && git add d &&
|
|
test_tick && git commit -S -m "bad" &&
|
|
git cat-file commit HEAD >raw &&
|
|
sed -e "s/^bad/forged bad/" raw >forged &&
|
|
git hash-object -w -t commit forged >forged.commit &&
|
|
git checkout $(cat forged.commit)
|
|
) &&
|
|
|
|
git clone . untrusted &&
|
|
(
|
|
cd untrusted &&
|
|
echo 5 >e && git add e &&
|
|
test_tick && git commit -SB7227189 -m "untrusted"
|
|
)
|
|
'
|
|
|
|
test_expect_success GPG 'pull unsigned commit with --verify-signatures' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
test_must_fail git pull --ff-only --verify-signatures unsigned 2>pullerror &&
|
|
test_i18ngrep "does not have a GPG signature" pullerror
|
|
'
|
|
|
|
test_expect_success GPG 'pull commit with bad signature with --verify-signatures' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
test_must_fail git pull --ff-only --verify-signatures bad 2>pullerror &&
|
|
test_i18ngrep "has a bad GPG signature" pullerror
|
|
'
|
|
|
|
test_expect_success GPG 'pull commit with untrusted signature with --verify-signatures' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
test_must_fail git pull --ff-only --verify-signatures untrusted 2>pullerror &&
|
|
test_i18ngrep "has an untrusted GPG signature" pullerror
|
|
'
|
|
|
|
test_expect_success GPG 'pull signed commit with --verify-signatures' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
git pull --verify-signatures signed >pulloutput &&
|
|
test_i18ngrep "has a good GPG signature" pulloutput
|
|
'
|
|
|
|
test_expect_success GPG 'pull commit with bad signature without verification' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
git pull --ff-only bad 2>pullerror
|
|
'
|
|
|
|
test_expect_success GPG 'pull commit with bad signature with --no-verify-signatures' '
|
|
test_when_finished "git reset --hard && git checkout initial" &&
|
|
test_config merge.verifySignatures true &&
|
|
test_config pull.verifySignatures true &&
|
|
git pull --ff-only --no-verify-signatures bad 2>pullerror
|
|
'
|
|
|
|
test_done
|