1 # We always set GNUPGHOME, even if no usable GPG was found, as
3 # - It does not hurt, and
5 # - we cannot set global environment variables in lazy prereqs because they are
6 # executed in an eval'ed subshell that changes the working directory to a
9 GNUPGHOME
="$PWD/gpghome"
12 test_lazy_prereq GPG
'
13 gpg_version=$(gpg --version 2>&1)
14 test $? != 127 || exit 1
16 # As said here: http://www.gnupg.org/documentation/faqs.html#q6.19
17 # the gpg version 1.0.6 did not parse trust packets correctly, so for
18 # that version, creation of signed tags using the generated key fails.
19 case "$gpg_version" in
21 say "Your version of gpg (1.0.6) is too buggy for testing"
26 # * Type DSA and Elgamal, size 2048 bits, no expiration date,
27 # name and email: C O Mitter <committer@example.com>
28 # * Type RSA, size 2048 bits, no expiration date,
29 # name and email: Eris Discordia <discord@example.net>
30 # No password given, to enable non-interactive operation.
31 # To generate new key:
32 # gpg --homedir /tmp/gpghome --gen-key
33 # To write armored exported key to keyring:
34 # gpg --homedir /tmp/gpghome --export-secret-keys \
35 # --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
36 # gpg --homedir /tmp/gpghome --export \
37 # --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
38 # To export ownertrust:
39 # gpg --homedir /tmp/gpghome --export-ownertrust \
40 # > lib-gpg/ownertrust
42 chmod 0700 "$GNUPGHOME" &&
43 (gpgconf --kill gpg-agent || : ) &&
44 gpg --homedir "${GNUPGHOME}" --import \
45 "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
46 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
47 "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
48 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
49 --sign -u committer@example.com
54 test_lazy_prereq GPGSM
'
55 test_have_prereq GPG &&
57 # * see t/lib-gpg/gpgsm-gen-key.in
58 # To generate new certificate:
60 # gpgsm --homedir /tmp/gpghome/ \
61 # -o /tmp/gpgsm.crt.user \
63 # --batch t/lib-gpg/gpgsm-gen-key.in
64 # To import certificate:
65 # gpgsm --homedir /tmp/gpghome/ \
66 # --import /tmp/gpgsm.crt.user
67 # To export into a .p12 we can later import:
68 # gpgsm --homedir /tmp/gpghome/ \
69 # -o t/lib-gpg/gpgsm_cert.p12 \
70 # --export-secret-key-p12 "committer@example.com"
71 echo | gpgsm --homedir "${GNUPGHOME}" \
72 --passphrase-fd 0 --pinentry-mode loopback \
73 --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
75 gpgsm --homedir "${GNUPGHOME}" -K |
78 tr -d "\\n" >"${GNUPGHOME}/trustlist.txt" &&
80 echo " S relax" >>"${GNUPGHOME}/trustlist.txt" &&
81 echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
82 -u committer@example.com -o /dev/null --sign -
85 test_lazy_prereq RFC1991
'
86 test_have_prereq GPG &&
87 echo | gpg --homedir "${GNUPGHOME}" -b --rfc1991 >/dev/null
90 GPGSSH_KEY_PRIMARY
="${GNUPGHOME}/ed25519_ssh_signing_key"
91 GPGSSH_KEY_SECONDARY
="${GNUPGHOME}/rsa_2048_ssh_signing_key"
92 GPGSSH_KEY_UNTRUSTED
="${GNUPGHOME}/untrusted_ssh_signing_key"
93 GPGSSH_KEY_WITH_PASSPHRASE
="${GNUPGHOME}/protected_ssh_signing_key"
94 GPGSSH_KEY_PASSPHRASE
="super_secret"
95 GPGSSH_ALLOWED_SIGNERS
="${GNUPGHOME}/ssh.all_valid.allowedSignersFile"
97 GPGSSH_GOOD_SIGNATURE_TRUSTED
='Good "git" signature for'
98 GPGSSH_GOOD_SIGNATURE_UNTRUSTED
='Good "git" signature with'
99 GPGSSH_KEY_NOT_TRUSTED
="No principal matched"
100 GPGSSH_BAD_SIGNATURE
="Signature verification failed"
102 test_lazy_prereq GPGSSH
'
103 ssh_version=$(ssh-keygen -Y find-principals -n "git" 2>&1)
104 test $? != 127 || exit 1
105 echo $ssh_version | grep -q "find-principals:missing signature file"
106 test $? = 0 || exit 1;
107 mkdir -p "${GNUPGHOME}" &&
108 chmod 0700 "${GNUPGHOME}" &&
109 (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
110 ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
111 echo "\"principal with number 1\" $(cat "${GPGSSH_KEY_PRIMARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
112 ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
113 echo "\"principal with number 2\" $(cat "${GPGSSH_KEY_SECONDARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
114 ssh-keygen -t ed25519 -N "${GPGSSH_KEY_PASSPHRASE}" -C "git ed25519 encrypted key" -f "${GPGSSH_KEY_WITH_PASSPHRASE}" >/dev/null &&
115 echo "\"principal with number 3\" $(cat "${GPGSSH_KEY_WITH_PASSPHRASE}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
116 ssh-keygen -t ed25519 -N "" -f "${GPGSSH_KEY_UNTRUSTED}" >/dev/null
121 /^-----END PGP/ and $in_pgp = 0;
122 print unless $in_pgp;
123 /^-----BEGIN PGP/ and $in_pgp = 1;