t/lib-gpg.sh

   1 # We always set GNUPGHOME, even if no usable GPG was found, as
   2 #
   3 # - It does not hurt, and
   4 #
   5 # - we cannot set global environment variables in lazy prereqs because they are
   6 #   executed in an eval'ed subshell that changes the working directory to a
   7 #   temporary one.
   8
   9 GNUPGHOME="$PWD/gpghome"
  10 export GNUPGHOME
  11
  12 test_lazy_prereq GPG '
  13         gpg_version=$(gpg --version 2>&1)
  14         test $? != 127 || exit 1
  15
  16         # As said here: https://web.archive.org/web/20130212022238/https://www.gnupg.org/faq/gnupg-faq.html#why-does-gnupg-1.0.6-bail-out-on-keyrings-used-with-1.0.7
  17         # the gpg version 1.0.6 did not parse trust packets correctly, so for
  18         # that version, creation of signed tags using the generated key fails.
  19         case "$gpg_version" in
  20         "gpg (GnuPG) 1.0.6"*)
  21                 say "Your version of gpg (1.0.6) is too buggy for testing"
  22                 exit 1
  23                 ;;
  24         *)
  25                 # Available key info:
  26                 # * Type DSA and Elgamal, size 2048 bits, no expiration date,
  27                 #   name and email: C O Mitter <committer@example.com>
  28                 # * Type RSA, size 2048 bits, no expiration date,
  29                 #   name and email: Eris Discordia <discord@example.net>
  30                 # No password given, to enable non-interactive operation.
  31                 # To generate new key:
  32                 #       gpg --homedir /tmp/gpghome --gen-key
  33                 # To write armored exported key to keyring:
  34                 #       gpg --homedir /tmp/gpghome --export-secret-keys \
  35                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  36                 #       gpg --homedir /tmp/gpghome --export \
  37                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  38                 # To export ownertrust:
  39                 #       gpg --homedir /tmp/gpghome --export-ownertrust \
  40                 #               > lib-gpg/ownertrust
  41                 mkdir "$GNUPGHOME" &&
  42                 chmod 0700 "$GNUPGHOME" &&
  43                 (gpgconf --kill all || : ) &&
  44                 gpg --homedir "${GNUPGHOME}" --import \
  45                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  46                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  47                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  48                 gpg --homedir "${GNUPGHOME}" --update-trustdb &&
  49                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  50                         --sign -u committer@example.com
  51                 ;;
  52         esac
  53 '
  54
  55 test_lazy_prereq GPG2 '
  56         gpg_version=$(gpg --version 2>&1)
  57         test $? != 127 || exit 1
  58
  59         case "$gpg_version" in
  60         "gpg (GnuPG) "[01].*)
  61                 say "This test requires a GPG version >= v2.0.0"
  62                 exit 1
  63                 ;;
  64         *)
  65                 (gpgconf --kill all || : ) &&
  66                 gpg --homedir "${GNUPGHOME}" --import \
  67                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  68                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  69                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  70                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  71                         --sign -u committer@example.com
  72                 ;;
  73         esac
  74 '
  75
  76 test_lazy_prereq GPGSM '
  77         test_have_prereq GPG &&
  78         # Available key info:
  79         # * see t/lib-gpg/gpgsm-gen-key.in
  80         # To generate new certificate:
  81         #  * no passphrase
  82         #       gpgsm --homedir /tmp/gpghome/ \
  83         #               -o /tmp/gpgsm.crt.user \
  84         #               --generate-key \
  85         #               --batch t/lib-gpg/gpgsm-gen-key.in
  86         # To import certificate:
  87         #       gpgsm --homedir /tmp/gpghome/ \
  88         #               --import /tmp/gpgsm.crt.user
  89         # To export into a .p12 we can later import:
  90         #       gpgsm --homedir /tmp/gpghome/ \
  91         #               -o t/lib-gpg/gpgsm_cert.p12 \
  92         #               --export-secret-key-p12 "committer@example.com"
  93         echo | gpgsm --homedir "${GNUPGHOME}" \
  94                 --passphrase-fd 0 --pinentry-mode loopback \
  95                 --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
  96
  97         gpgsm --homedir "${GNUPGHOME}" -K --with-colons |
  98         awk -F ":" "/^fpr:/ {printf \"%s S relax\\n\", \$10}" \
  99                 >"${GNUPGHOME}/trustlist.txt" &&
 100         (gpgconf --reload all || : ) &&
 101
 102         echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
 103                -u committer@example.com -o /dev/null --sign -
 104 '
 105
 106 test_lazy_prereq RFC1991 '
 107         test_have_prereq GPG &&
 108         echo | gpg --homedir "${GNUPGHOME}" -b --rfc1991 >/dev/null
 109 '
 110
 111 GPGSSH_KEY_PRIMARY="${GNUPGHOME}/ed25519_ssh_signing_key"
 112 GPGSSH_KEY_SECONDARY="${GNUPGHOME}/rsa_2048_ssh_signing_key"
 113 GPGSSH_KEY_UNTRUSTED="${GNUPGHOME}/untrusted_ssh_signing_key"
 114 GPGSSH_KEY_EXPIRED="${GNUPGHOME}/expired_ssh_signing_key"
 115 GPGSSH_KEY_NOTYETVALID="${GNUPGHOME}/notyetvalid_ssh_signing_key"
 116 GPGSSH_KEY_TIMEBOXEDVALID="${GNUPGHOME}/timeboxed_valid_ssh_signing_key"
 117 GPGSSH_KEY_TIMEBOXEDINVALID="${GNUPGHOME}/timeboxed_invalid_ssh_signing_key"
 118 GPGSSH_KEY_WITH_PASSPHRASE="${GNUPGHOME}/protected_ssh_signing_key"
 119 GPGSSH_KEY_ECDSA="${GNUPGHOME}/ecdsa_ssh_signing_key"
 120 GPGSSH_KEY_PASSPHRASE="super_secret"
 121 GPGSSH_ALLOWED_SIGNERS="${GNUPGHOME}/ssh.all_valid.allowedSignersFile"
 122
 123 GPGSSH_GOOD_SIGNATURE_TRUSTED='Good "git" signature for'
 124 GPGSSH_GOOD_SIGNATURE_UNTRUSTED='Good "git" signature with'
 125 GPGSSH_KEY_NOT_TRUSTED="No principal matched"
 126 GPGSSH_BAD_SIGNATURE="Signature verification failed"
 127
 128 test_lazy_prereq GPGSSH '
 129         ssh_version=$(ssh-keygen -Y find-principals -n "git" 2>&1)
 130         test $? != 127 || exit 1
 131         echo $ssh_version | grep -q "find-principals:missing signature file"
 132         test $? = 0 || exit 1;
 133
 134         # Setup some keys and an allowed signers file
 135         mkdir -p "${GNUPGHOME}" &&
 136         chmod 0700 "${GNUPGHOME}" &&
 137         (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
 138         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
 139         ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
 140         ssh-keygen -t ed25519 -N "${GPGSSH_KEY_PASSPHRASE}" -C "git ed25519 encrypted key" -f "${GPGSSH_KEY_WITH_PASSPHRASE}" >/dev/null &&
 141         ssh-keygen -t ecdsa -N "" -f "${GPGSSH_KEY_ECDSA}" >/dev/null &&
 142         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_UNTRUSTED}" >/dev/null &&
 143
 144         cat >"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 145         "principal with number 1" $(cat "${GPGSSH_KEY_PRIMARY}.pub")"
 146         "principal with number 2" $(cat "${GPGSSH_KEY_SECONDARY}.pub")"
 147         "principal with number 3" $(cat "${GPGSSH_KEY_WITH_PASSPHRASE}.pub")"
 148         "principal with number 4" $(cat "${GPGSSH_KEY_ECDSA}.pub")"
 149         EOF
 150
 151         # Verify if at least one key and ssh-keygen works as expected
 152         echo "testpayload" |
 153         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_PRIMARY}" >gpgssh_prereq.sig &&
 154         ssh-keygen -Y find-principals -f "${GPGSSH_ALLOWED_SIGNERS}" -s gpgssh_prereq.sig &&
 155         echo "testpayload" |
 156         ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with number 1" -s gpgssh_prereq.sig
 157 '
 158
 159 test_lazy_prereq GPGSSH_VERIFYTIME '
 160         test_have_prereq GPGSSH &&
 161         # Check if ssh-keygen has a verify-time option by passing an invalid date to it
 162         ssh-keygen -Overify-time=INVALID -Y check-novalidate -n "git" -s doesnotmatter 2>&1 | grep -q -F "Invalid \"verify-time\"" &&
 163
 164         # Set up keys with key lifetimes
 165         ssh-keygen -t ed25519 -N "" -C "timeboxed valid key" -f "${GPGSSH_KEY_TIMEBOXEDVALID}" >/dev/null &&
 166         key_valid=$(cat "${GPGSSH_KEY_TIMEBOXEDVALID}.pub") &&
 167         ssh-keygen -t ed25519 -N "" -C "timeboxed invalid key" -f "${GPGSSH_KEY_TIMEBOXEDINVALID}" >/dev/null &&
 168         key_invalid=$(cat "${GPGSSH_KEY_TIMEBOXEDINVALID}.pub") &&
 169         ssh-keygen -t ed25519 -N "" -C "expired key" -f "${GPGSSH_KEY_EXPIRED}" >/dev/null &&
 170         key_expired=$(cat "${GPGSSH_KEY_EXPIRED}.pub") &&
 171         ssh-keygen -t ed25519 -N "" -C "not yet valid key" -f "${GPGSSH_KEY_NOTYETVALID}" >/dev/null &&
 172         key_notyetvalid=$(cat "${GPGSSH_KEY_NOTYETVALID}.pub") &&
 173
 174         # Timestamps outside of test_tick span
 175         ts2005a=20050401000000 ts2005b=200504020000 &&
 176         # Timestamps within test_tick span
 177         ts2005c=20050407000000 ts2005d=200504100000 &&
 178         # Definitely not yet valid / expired timestamps
 179         ts2000=20000101000000 ts2999=29990101000000 &&
 180
 181         cat >>"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 182         "timeboxed valid key" valid-after="$ts2005c",valid-before="$ts2005d" $key_valid"
 183         "timeboxed invalid key" valid-after="$ts2005a",valid-before="$ts2005b" $key_invalid"
 184         "principal with expired key" valid-before="$ts2000" $key_expired"
 185         "principal with not yet valid key" valid-after="$ts2999" $key_notyetvalid"
 186         EOF
 187
 188         # and verify ssh-keygen verifies the key lifetime
 189         echo "testpayload" |
 190         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_EXPIRED}" >gpgssh_verifytime_prereq.sig &&
 191         ! (ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with expired key" -s gpgssh_verifytime_prereq.sig)
 192 '
 193
 194 sanitize_pgp() {
 195         perl -ne '
 196                 /^-----END PGP/ and $in_pgp = 0;
 197                 print unless $in_pgp;
 198                 /^-----BEGIN PGP/ and $in_pgp = 1;
 199         '
 200 }