t/t7030-verify-tag.sh

   1 #!/bin/sh
   2
   3 test_description='signed tag tests'
   4 . ./test-lib.sh
   5 . "$TEST_DIRECTORY/lib-gpg.sh"
   6
   7 test_expect_success GPG 'create signed tags' '
   8         echo 1 >file && git add file &&
   9         test_tick && git commit -m initial &&
  10         git tag -s -m initial initial &&
  11         git branch side &&
  12
  13         echo 2 >file && test_tick && git commit -a -m second &&
  14         git tag -s -m second second &&
  15
  16         git checkout side &&
  17         echo 3 >elif && git add elif &&
  18         test_tick && git commit -m "third on side" &&
  19
  20         git checkout master &&
  21         test_tick && git merge -S side &&
  22         git tag -s -m merge merge &&
  23
  24         echo 4 >file && test_tick && git commit -a -S -m "fourth unsigned" &&
  25         git tag -a -m fourth-unsigned fourth-unsigned &&
  26
  27         test_tick && git commit --amend -S -m "fourth signed" &&
  28         git tag -s -m fourth fourth-signed &&
  29
  30         echo 5 >file && test_tick && git commit -a -m "fifth" &&
  31         git tag fifth-unsigned &&
  32
  33         git config commit.gpgsign true &&
  34         echo 6 >file && test_tick && git commit -a -m "sixth" &&
  35         git tag -a -m sixth sixth-unsigned &&
  36
  37         test_tick && git rebase -f HEAD^^ && git tag -s -m 6th sixth-signed HEAD^ &&
  38         git tag -m seventh -s seventh-signed &&
  39
  40         echo 8 >file && test_tick && git commit -a -m eighth &&
  41         git tag -uB7227189 -m eighth eighth-signed-alt
  42 '
  43
  44 test_expect_success GPGSM 'create signed tags x509 ' '
  45         test_config gpg.format x509 &&
  46         test_config user.signingkey $GIT_COMMITTER_EMAIL &&
  47         echo 9 >file && test_tick && git commit -a -m "ninth gpgsm-signed" &&
  48         git tag -s -m ninth ninth-signed-x509
  49 '
  50
  51 test_expect_success GPG 'verify and show signatures' '
  52         (
  53                 for tag in initial second merge fourth-signed sixth-signed seventh-signed
  54                 do
  55                         git verify-tag $tag 2>actual &&
  56                         grep "Good signature from" actual &&
  57                         ! grep "BAD signature from" actual &&
  58                         echo $tag OK || exit 1
  59                 done
  60         ) &&
  61         (
  62                 for tag in fourth-unsigned fifth-unsigned sixth-unsigned
  63                 do
  64                         test_must_fail git verify-tag $tag 2>actual &&
  65                         ! grep "Good signature from" actual &&
  66                         ! grep "BAD signature from" actual &&
  67                         echo $tag OK || exit 1
  68                 done
  69         ) &&
  70         (
  71                 for tag in eighth-signed-alt
  72                 do
  73                         git verify-tag $tag 2>actual &&
  74                         grep "Good signature from" actual &&
  75                         ! grep "BAD signature from" actual &&
  76                         grep "not certified" actual &&
  77                         echo $tag OK || exit 1
  78                 done
  79         )
  80 '
  81
  82 test_expect_success GPGSM 'verify and show signatures x509' '
  83         git verify-tag ninth-signed-x509 2>actual &&
  84         grep "Good signature from" actual &&
  85         ! grep "BAD signature from" actual &&
  86         echo ninth-signed-x509 OK
  87 '
  88
  89 test_expect_success GPGSM 'verify and show signatures x509 with low minTrustLevel' '
  90         test_config gpg.minTrustLevel undefined &&
  91         git verify-tag ninth-signed-x509 2>actual &&
  92         grep "Good signature from" actual &&
  93         ! grep "BAD signature from" actual &&
  94         echo ninth-signed-x509 OK
  95 '
  96
  97 test_expect_success GPGSM 'verify and show signatures x509 with matching minTrustLevel' '
  98         test_config gpg.minTrustLevel fully &&
  99         git verify-tag ninth-signed-x509 2>actual &&
 100         grep "Good signature from" actual &&
 101         ! grep "BAD signature from" actual &&
 102         echo ninth-signed-x509 OK
 103 '
 104
 105 test_expect_success GPGSM 'verify and show signatures x509 with high minTrustLevel' '
 106         test_config gpg.minTrustLevel ultimate &&
 107         test_must_fail git verify-tag ninth-signed-x509 2>actual &&
 108         grep "Good signature from" actual &&
 109         ! grep "BAD signature from" actual &&
 110         echo ninth-signed-x509 OK
 111 '
 112
 113 test_expect_success GPG 'detect fudged signature' '
 114         git cat-file tag seventh-signed >raw &&
 115         sed -e "/^tag / s/seventh/7th forged/" raw >forged1 &&
 116         git hash-object -w -t tag forged1 >forged1.tag &&
 117         test_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&
 118         grep "BAD signature from" actual1 &&
 119         ! grep "Good signature from" actual1
 120 '
 121
 122 test_expect_success GPG 'verify signatures with --raw' '
 123         (
 124                 for tag in initial second merge fourth-signed sixth-signed seventh-signed
 125                 do
 126                         git verify-tag --raw $tag 2>actual &&
 127                         grep "GOODSIG" actual &&
 128                         ! grep "BADSIG" actual &&
 129                         echo $tag OK || exit 1
 130                 done
 131         ) &&
 132         (
 133                 for tag in fourth-unsigned fifth-unsigned sixth-unsigned
 134                 do
 135                         test_must_fail git verify-tag --raw $tag 2>actual &&
 136                         ! grep "GOODSIG" actual &&
 137                         ! grep "BADSIG" actual &&
 138                         echo $tag OK || exit 1
 139                 done
 140         ) &&
 141         (
 142                 for tag in eighth-signed-alt
 143                 do
 144                         git verify-tag --raw $tag 2>actual &&
 145                         grep "GOODSIG" actual &&
 146                         ! grep "BADSIG" actual &&
 147                         grep "TRUST_UNDEFINED" actual &&
 148                         echo $tag OK || exit 1
 149                 done
 150         )
 151 '
 152
 153 test_expect_success GPGSM 'verify signatures with --raw x509' '
 154         git verify-tag --raw ninth-signed-x509 2>actual &&
 155         grep "GOODSIG" actual &&
 156         ! grep "BADSIG" actual &&
 157         echo ninth-signed-x509 OK
 158 '
 159
 160 test_expect_success GPG 'verify multiple tags' '
 161         tags="fourth-signed sixth-signed seventh-signed" &&
 162         for i in $tags
 163         do
 164                 git verify-tag -v --raw $i || return 1
 165         done >expect.stdout 2>expect.stderr.1 &&
 166         grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
 167         git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
 168         grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
 169         test_cmp expect.stdout actual.stdout &&
 170         test_cmp expect.stderr actual.stderr
 171 '
 172
 173 test_expect_success GPGSM 'verify multiple tags x509' '
 174         tags="seventh-signed ninth-signed-x509" &&
 175         for i in $tags
 176         do
 177                 git verify-tag -v --raw $i || return 1
 178         done >expect.stdout 2>expect.stderr.1 &&
 179         grep "^.GNUPG:." <expect.stderr.1 >expect.stderr &&
 180         git verify-tag -v --raw $tags >actual.stdout 2>actual.stderr.1 &&
 181         grep "^.GNUPG:." <actual.stderr.1 >actual.stderr &&
 182         test_cmp expect.stdout actual.stdout &&
 183         test_cmp expect.stderr actual.stderr
 184 '
 185
 186 test_expect_success GPG 'verifying tag with --format' '
 187         cat >expect <<-\EOF &&
 188         tagname : fourth-signed
 189         EOF
 190         git verify-tag --format="tagname : %(tag)" "fourth-signed" >actual &&
 191         test_cmp expect actual
 192 '
 193
 194 test_expect_success GPG 'verifying a forged tag with --format should fail silently' '
 195         test_must_fail git verify-tag --format="tagname : %(tag)" $(cat forged1.tag) >actual-forged &&
 196         test_must_be_empty actual-forged
 197 '
 198
 199 test_done