t/lib-gpg.sh

   1 # We always set GNUPGHOME, even if no usable GPG was found, as
   2 #
   3 # - It does not hurt, and
   4 #
   5 # - we cannot set global environment variables in lazy prereqs because they are
   6 #   executed in an eval'ed subshell that changes the working directory to a
   7 #   temporary one.
   8
   9 GNUPGHOME="$PWD/gpghome"
  10 export GNUPGHOME
  11
  12 test_lazy_prereq GPG '
  13         gpg_version=$(gpg --version 2>&1)
  14         test $? != 127 || exit 1
  15
  16         # As said here: http://www.gnupg.org/documentation/faqs.html#q6.19
  17         # the gpg version 1.0.6 did not parse trust packets correctly, so for
  18         # that version, creation of signed tags using the generated key fails.
  19         case "$gpg_version" in
  20         "gpg (GnuPG) 1.0.6"*)
  21                 say "Your version of gpg (1.0.6) is too buggy for testing"
  22                 exit 1
  23                 ;;
  24         *)
  25                 # Available key info:
  26                 # * Type DSA and Elgamal, size 2048 bits, no expiration date,
  27                 #   name and email: C O Mitter <committer@example.com>
  28                 # * Type RSA, size 2048 bits, no expiration date,
  29                 #   name and email: Eris Discordia <discord@example.net>
  30                 # No password given, to enable non-interactive operation.
  31                 # To generate new key:
  32                 #       gpg --homedir /tmp/gpghome --gen-key
  33                 # To write armored exported key to keyring:
  34                 #       gpg --homedir /tmp/gpghome --export-secret-keys \
  35                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  36                 #       gpg --homedir /tmp/gpghome --export \
  37                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  38                 # To export ownertrust:
  39                 #       gpg --homedir /tmp/gpghome --export-ownertrust \
  40                 #               > lib-gpg/ownertrust
  41                 mkdir "$GNUPGHOME" &&
  42                 chmod 0700 "$GNUPGHOME" &&
  43                 (gpgconf --kill all || : ) &&
  44                 gpg --homedir "${GNUPGHOME}" --import \
  45                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  46                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  47                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  48                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  49                         --sign -u committer@example.com
  50                 ;;
  51         esac
  52 '
  53
  54 test_lazy_prereq GPG2 '
  55         gpg_version=$(gpg --version 2>&1)
  56         test $? != 127 || exit 1
  57
  58         case "$gpg_version" in
  59         "gpg (GnuPG) "[01].*)
  60                 say "This test requires a GPG version >= v2.0.0"
  61                 exit 1
  62                 ;;
  63         *)
  64                 (gpgconf --kill all || : ) &&
  65                 gpg --homedir "${GNUPGHOME}" --import \
  66                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  67                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  68                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  69                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  70                         --sign -u committer@example.com
  71                 ;;
  72         esac
  73 '
  74
  75 test_lazy_prereq GPGSM '
  76         test_have_prereq GPG &&
  77         # Available key info:
  78         # * see t/lib-gpg/gpgsm-gen-key.in
  79         # To generate new certificate:
  80         #  * no passphrase
  81         #       gpgsm --homedir /tmp/gpghome/ \
  82         #               -o /tmp/gpgsm.crt.user \
  83         #               --generate-key \
  84         #               --batch t/lib-gpg/gpgsm-gen-key.in
  85         # To import certificate:
  86         #       gpgsm --homedir /tmp/gpghome/ \
  87         #               --import /tmp/gpgsm.crt.user
  88         # To export into a .p12 we can later import:
  89         #       gpgsm --homedir /tmp/gpghome/ \
  90         #               -o t/lib-gpg/gpgsm_cert.p12 \
  91         #               --export-secret-key-p12 "committer@example.com"
  92         echo | gpgsm --homedir "${GNUPGHOME}" \
  93                 --passphrase-fd 0 --pinentry-mode loopback \
  94                 --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
  95
  96         gpgsm --homedir "${GNUPGHOME}" -K --with-colons |
  97         awk -F ":" "/^fpr:/ {printf \"%s S relax\\n\", \$10}" \
  98                 >"${GNUPGHOME}/trustlist.txt" &&
  99         (gpgconf --reload all || : ) &&
 100
 101         echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
 102                -u committer@example.com -o /dev/null --sign -
 103 '
 104
 105 test_lazy_prereq RFC1991 '
 106         test_have_prereq GPG &&
 107         echo | gpg --homedir "${GNUPGHOME}" -b --rfc1991 >/dev/null
 108 '
 109
 110 GPGSSH_KEY_PRIMARY="${GNUPGHOME}/ed25519_ssh_signing_key"
 111 GPGSSH_KEY_SECONDARY="${GNUPGHOME}/rsa_2048_ssh_signing_key"
 112 GPGSSH_KEY_UNTRUSTED="${GNUPGHOME}/untrusted_ssh_signing_key"
 113 GPGSSH_KEY_EXPIRED="${GNUPGHOME}/expired_ssh_signing_key"
 114 GPGSSH_KEY_NOTYETVALID="${GNUPGHOME}/notyetvalid_ssh_signing_key"
 115 GPGSSH_KEY_TIMEBOXEDVALID="${GNUPGHOME}/timeboxed_valid_ssh_signing_key"
 116 GPGSSH_KEY_TIMEBOXEDINVALID="${GNUPGHOME}/timeboxed_invalid_ssh_signing_key"
 117 GPGSSH_KEY_WITH_PASSPHRASE="${GNUPGHOME}/protected_ssh_signing_key"
 118 GPGSSH_KEY_ECDSA="${GNUPGHOME}/ecdsa_ssh_signing_key"
 119 GPGSSH_KEY_PASSPHRASE="super_secret"
 120 GPGSSH_ALLOWED_SIGNERS="${GNUPGHOME}/ssh.all_valid.allowedSignersFile"
 121
 122 GPGSSH_GOOD_SIGNATURE_TRUSTED='Good "git" signature for'
 123 GPGSSH_GOOD_SIGNATURE_UNTRUSTED='Good "git" signature with'
 124 GPGSSH_KEY_NOT_TRUSTED="No principal matched"
 125 GPGSSH_BAD_SIGNATURE="Signature verification failed"
 126
 127 test_lazy_prereq GPGSSH '
 128         ssh_version=$(ssh-keygen -Y find-principals -n "git" 2>&1)
 129         test $? != 127 || exit 1
 130         echo $ssh_version | grep -q "find-principals:missing signature file"
 131         test $? = 0 || exit 1;
 132
 133         # Setup some keys and an allowed signers file
 134         mkdir -p "${GNUPGHOME}" &&
 135         chmod 0700 "${GNUPGHOME}" &&
 136         (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
 137         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
 138         ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
 139         ssh-keygen -t ed25519 -N "${GPGSSH_KEY_PASSPHRASE}" -C "git ed25519 encrypted key" -f "${GPGSSH_KEY_WITH_PASSPHRASE}" >/dev/null &&
 140         ssh-keygen -t ecdsa -N "" -f "${GPGSSH_KEY_ECDSA}" >/dev/null &&
 141         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_UNTRUSTED}" >/dev/null &&
 142
 143         cat >"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 144         "principal with number 1" $(cat "${GPGSSH_KEY_PRIMARY}.pub")"
 145         "principal with number 2" $(cat "${GPGSSH_KEY_SECONDARY}.pub")"
 146         "principal with number 3" $(cat "${GPGSSH_KEY_WITH_PASSPHRASE}.pub")"
 147         "principal with number 4" $(cat "${GPGSSH_KEY_ECDSA}.pub")"
 148         EOF
 149
 150         # Verify if at least one key and ssh-keygen works as expected
 151         echo "testpayload" |
 152         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_PRIMARY}" >gpgssh_prereq.sig &&
 153         ssh-keygen -Y find-principals -f "${GPGSSH_ALLOWED_SIGNERS}" -s gpgssh_prereq.sig &&
 154         echo "testpayload" |
 155         ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with number 1" -s gpgssh_prereq.sig
 156 '
 157
 158 test_lazy_prereq GPGSSH_VERIFYTIME '
 159         test_have_prereq GPGSSH &&
 160         # Check if ssh-keygen has a verify-time option by passing an invalid date to it
 161         ssh-keygen -Overify-time=INVALID -Y check-novalidate -n "git" -s doesnotmatter 2>&1 | grep -q -F "Invalid \"verify-time\"" &&
 162
 163         # Set up keys with key lifetimes
 164         ssh-keygen -t ed25519 -N "" -C "timeboxed valid key" -f "${GPGSSH_KEY_TIMEBOXEDVALID}" >/dev/null &&
 165         key_valid=$(cat "${GPGSSH_KEY_TIMEBOXEDVALID}.pub") &&
 166         ssh-keygen -t ed25519 -N "" -C "timeboxed invalid key" -f "${GPGSSH_KEY_TIMEBOXEDINVALID}" >/dev/null &&
 167         key_invalid=$(cat "${GPGSSH_KEY_TIMEBOXEDINVALID}.pub") &&
 168         ssh-keygen -t ed25519 -N "" -C "expired key" -f "${GPGSSH_KEY_EXPIRED}" >/dev/null &&
 169         key_expired=$(cat "${GPGSSH_KEY_EXPIRED}.pub") &&
 170         ssh-keygen -t ed25519 -N "" -C "not yet valid key" -f "${GPGSSH_KEY_NOTYETVALID}" >/dev/null &&
 171         key_notyetvalid=$(cat "${GPGSSH_KEY_NOTYETVALID}.pub") &&
 172
 173         # Timestamps outside of test_tick span
 174         ts2005a=20050401000000 ts2005b=200504020000 &&
 175         # Timestamps within test_tick span
 176         ts2005c=20050407000000 ts2005d=200504100000 &&
 177         # Definitely not yet valid / expired timestamps
 178         ts2000=20000101000000 ts2999=29990101000000 &&
 179
 180         cat >>"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 181         "timeboxed valid key" valid-after="$ts2005c",valid-before="$ts2005d" $key_valid"
 182         "timeboxed invalid key" valid-after="$ts2005a",valid-before="$ts2005b" $key_invalid"
 183         "principal with expired key" valid-before="$ts2000" $key_expired"
 184         "principal with not yet valid key" valid-after="$ts2999" $key_notyetvalid"
 185         EOF
 186
 187         # and verify ssh-keygen verifies the key lifetime
 188         echo "testpayload" |
 189         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_EXPIRED}" >gpgssh_verifytime_prereq.sig &&
 190         ! (ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with expired key" -s gpgssh_verifytime_prereq.sig)
 191 '
 192
 193 sanitize_pgp() {
 194         perl -ne '
 195                 /^-----END PGP/ and $in_pgp = 0;
 196                 print unless $in_pgp;
 197                 /^-----BEGIN PGP/ and $in_pgp = 1;
 198         '
 199 }