t/lib-gpg.sh

   1 # We always set GNUPGHOME, even if no usable GPG was found, as
   2 #
   3 # - It does not hurt, and
   4 #
   5 # - we cannot set global environment variables in lazy prereqs because they are
   6 #   executed in an eval'ed subshell that changes the working directory to a
   7 #   temporary one.
   8
   9 GNUPGHOME="$PWD/gpghome"
  10 export GNUPGHOME
  11
  12 test_lazy_prereq GPG '
  13         gpg_version=$(gpg --version 2>&1)
  14         test $? != 127 || exit 1
  15
  16         # As said here: http://www.gnupg.org/documentation/faqs.html#q6.19
  17         # the gpg version 1.0.6 did not parse trust packets correctly, so for
  18         # that version, creation of signed tags using the generated key fails.
  19         case "$gpg_version" in
  20         "gpg (GnuPG) 1.0.6"*)
  21                 say "Your version of gpg (1.0.6) is too buggy for testing"
  22                 exit 1
  23                 ;;
  24         *)
  25                 # Available key info:
  26                 # * Type DSA and Elgamal, size 2048 bits, no expiration date,
  27                 #   name and email: C O Mitter <committer@example.com>
  28                 # * Type RSA, size 2048 bits, no expiration date,
  29                 #   name and email: Eris Discordia <discord@example.net>
  30                 # No password given, to enable non-interactive operation.
  31                 # To generate new key:
  32                 #       gpg --homedir /tmp/gpghome --gen-key
  33                 # To write armored exported key to keyring:
  34                 #       gpg --homedir /tmp/gpghome --export-secret-keys \
  35                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  36                 #       gpg --homedir /tmp/gpghome --export \
  37                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  38                 # To export ownertrust:
  39                 #       gpg --homedir /tmp/gpghome --export-ownertrust \
  40                 #               > lib-gpg/ownertrust
  41                 mkdir "$GNUPGHOME" &&
  42                 chmod 0700 "$GNUPGHOME" &&
  43                 (gpgconf --kill gpg-agent || : ) &&
  44                 gpg --homedir "${GNUPGHOME}" --import \
  45                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  46                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  47                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  48                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  49                         --sign -u committer@example.com
  50                 ;;
  51         esac
  52 '
  53
  54 test_lazy_prereq GPGSM '
  55         test_have_prereq GPG &&
  56         # Available key info:
  57         # * see t/lib-gpg/gpgsm-gen-key.in
  58         # To generate new certificate:
  59         #  * no passphrase
  60         #       gpgsm --homedir /tmp/gpghome/ \
  61         #               -o /tmp/gpgsm.crt.user \
  62         #               --generate-key \
  63         #               --batch t/lib-gpg/gpgsm-gen-key.in
  64         # To import certificate:
  65         #       gpgsm --homedir /tmp/gpghome/ \
  66         #               --import /tmp/gpgsm.crt.user
  67         # To export into a .p12 we can later import:
  68         #       gpgsm --homedir /tmp/gpghome/ \
  69         #               -o t/lib-gpg/gpgsm_cert.p12 \
  70         #               --export-secret-key-p12 "committer@example.com"
  71         echo | gpgsm --homedir "${GNUPGHOME}" \
  72                 --passphrase-fd 0 --pinentry-mode loopback \
  73                 --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
  74
  75         gpgsm --homedir "${GNUPGHOME}" -K |
  76         grep fingerprint: |
  77         cut -d" " -f4 |
  78         tr -d "\\n" >"${GNUPGHOME}/trustlist.txt" &&
  79
  80         echo " S relax" >>"${GNUPGHOME}/trustlist.txt" &&
  81         echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
  82                -u committer@example.com -o /dev/null --sign -
  83 '
  84
  85 test_lazy_prereq RFC1991 '
  86         test_have_prereq GPG &&
  87         echo | gpg --homedir "${GNUPGHOME}" -b --rfc1991 >/dev/null
  88 '
  89
  90 GPGSSH_KEY_PRIMARY="${GNUPGHOME}/ed25519_ssh_signing_key"
  91 GPGSSH_KEY_SECONDARY="${GNUPGHOME}/rsa_2048_ssh_signing_key"
  92 GPGSSH_KEY_UNTRUSTED="${GNUPGHOME}/untrusted_ssh_signing_key"
  93 GPGSSH_KEY_WITH_PASSPHRASE="${GNUPGHOME}/protected_ssh_signing_key"
  94 GPGSSH_KEY_PASSPHRASE="super_secret"
  95 GPGSSH_ALLOWED_SIGNERS="${GNUPGHOME}/ssh.all_valid.allowedSignersFile"
  96
  97 GPGSSH_GOOD_SIGNATURE_TRUSTED='Good "git" signature for'
  98 GPGSSH_GOOD_SIGNATURE_UNTRUSTED='Good "git" signature with'
  99 GPGSSH_KEY_NOT_TRUSTED="No principal matched"
 100 GPGSSH_BAD_SIGNATURE="Signature verification failed"
 101
 102 test_lazy_prereq GPGSSH '
 103         ssh_version=$(ssh-keygen -Y find-principals -n "git" 2>&1)
 104         test $? != 127 || exit 1
 105         echo $ssh_version | grep -q "find-principals:missing signature file"
 106         test $? = 0 || exit 1;
 107
 108         # some broken versions of ssh-keygen segfault on find-principals;
 109         # avoid testing with them.
 110         ssh-keygen -Y find-principals -f /dev/null -s /dev/null
 111         test $? = 139 && exit 1
 112
 113         mkdir -p "${GNUPGHOME}" &&
 114         chmod 0700 "${GNUPGHOME}" &&
 115         (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
 116         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
 117         echo "\"principal with number 1\" $(cat "${GPGSSH_KEY_PRIMARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
 118         ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
 119         echo "\"principal with number 2\" $(cat "${GPGSSH_KEY_SECONDARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
 120         ssh-keygen -t ed25519 -N "${GPGSSH_KEY_PASSPHRASE}" -C "git ed25519 encrypted key" -f "${GPGSSH_KEY_WITH_PASSPHRASE}" >/dev/null &&
 121         echo "\"principal with number 3\" $(cat "${GPGSSH_KEY_WITH_PASSPHRASE}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
 122         ssh-keygen -t ed25519 -N "" -f "${GPGSSH_KEY_UNTRUSTED}" >/dev/null
 123 '
 124
 125 sanitize_pgp() {
 126         perl -ne '
 127                 /^-----END PGP/ and $in_pgp = 0;
 128                 print unless $in_pgp;
 129                 /^-----BEGIN PGP/ and $in_pgp = 1;
 130         '
 131 }