Git 2.27-rc2
[git.git] / gpg-interface.c
blob2d538bcd6e30d1314f76d89764284f8735cd187f
1 #include "cache.h"
2 #include "config.h"
3 #include "run-command.h"
4 #include "strbuf.h"
5 #include "gpg-interface.h"
6 #include "sigchain.h"
7 #include "tempfile.h"
9 static char *configured_signing_key;
10 static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;
12 struct gpg_format {
13 const char *name;
14 const char *program;
15 const char **verify_args;
16 const char **sigs;
19 static const char *openpgp_verify_args[] = {
20 "--keyid-format=long",
21 NULL
23 static const char *openpgp_sigs[] = {
24 "-----BEGIN PGP SIGNATURE-----",
25 "-----BEGIN PGP MESSAGE-----",
26 NULL
29 static const char *x509_verify_args[] = {
30 NULL
32 static const char *x509_sigs[] = {
33 "-----BEGIN SIGNED MESSAGE-----",
34 NULL
37 static struct gpg_format gpg_format[] = {
38 { .name = "openpgp", .program = "gpg",
39 .verify_args = openpgp_verify_args,
40 .sigs = openpgp_sigs
42 { .name = "x509", .program = "gpgsm",
43 .verify_args = x509_verify_args,
44 .sigs = x509_sigs
48 static struct gpg_format *use_format = &gpg_format[0];
50 static struct gpg_format *get_format_by_name(const char *str)
52 int i;
54 for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
55 if (!strcmp(gpg_format[i].name, str))
56 return gpg_format + i;
57 return NULL;
60 static struct gpg_format *get_format_by_sig(const char *sig)
62 int i, j;
64 for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
65 for (j = 0; gpg_format[i].sigs[j]; j++)
66 if (starts_with(sig, gpg_format[i].sigs[j]))
67 return gpg_format + i;
68 return NULL;
71 void signature_check_clear(struct signature_check *sigc)
73 FREE_AND_NULL(sigc->payload);
74 FREE_AND_NULL(sigc->gpg_output);
75 FREE_AND_NULL(sigc->gpg_status);
76 FREE_AND_NULL(sigc->signer);
77 FREE_AND_NULL(sigc->key);
78 FREE_AND_NULL(sigc->fingerprint);
79 FREE_AND_NULL(sigc->primary_key_fingerprint);
82 /* An exclusive status -- only one of them can appear in output */
83 #define GPG_STATUS_EXCLUSIVE (1<<0)
84 /* The status includes key identifier */
85 #define GPG_STATUS_KEYID (1<<1)
86 /* The status includes user identifier */
87 #define GPG_STATUS_UID (1<<2)
88 /* The status includes key fingerprints */
89 #define GPG_STATUS_FINGERPRINT (1<<3)
90 /* The status includes trust level */
91 #define GPG_STATUS_TRUST_LEVEL (1<<4)
93 /* Short-hand for standard exclusive *SIG status with keyid & UID */
94 #define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)
96 static struct {
97 char result;
98 const char *check;
99 unsigned int flags;
100 } sigcheck_gpg_status[] = {
101 { 'G', "GOODSIG ", GPG_STATUS_STDSIG },
102 { 'B', "BADSIG ", GPG_STATUS_STDSIG },
103 { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID },
104 { 'X', "EXPSIG ", GPG_STATUS_STDSIG },
105 { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
106 { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
107 { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
108 { 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
111 static struct {
112 const char *key;
113 enum signature_trust_level value;
114 } sigcheck_gpg_trust_level[] = {
115 { "UNDEFINED", TRUST_UNDEFINED },
116 { "NEVER", TRUST_NEVER },
117 { "MARGINAL", TRUST_MARGINAL },
118 { "FULLY", TRUST_FULLY },
119 { "ULTIMATE", TRUST_ULTIMATE },
122 static void replace_cstring(char **field, const char *line, const char *next)
124 free(*field);
126 if (line && next)
127 *field = xmemdupz(line, next - line);
128 else
129 *field = NULL;
132 static int parse_gpg_trust_level(const char *level,
133 enum signature_trust_level *res)
135 size_t i;
137 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
138 if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
139 *res = sigcheck_gpg_trust_level[i].value;
140 return 0;
143 return 1;
146 static void parse_gpg_output(struct signature_check *sigc)
148 const char *buf = sigc->gpg_status;
149 const char *line, *next;
150 int i, j;
151 int seen_exclusive_status = 0;
153 /* Iterate over all lines */
154 for (line = buf; *line; line = strchrnul(line+1, '\n')) {
155 while (*line == '\n')
156 line++;
157 if (!*line)
158 break;
160 /* Skip lines that don't start with GNUPG status */
161 if (!skip_prefix(line, "[GNUPG:] ", &line))
162 continue;
164 /* Iterate over all search strings */
165 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
166 if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
168 * GOODSIG, BADSIG etc. can occur only once for
169 * each signature. Therefore, if we had more
170 * than one then we're dealing with multiple
171 * signatures. We don't support them
172 * currently, and they're rather hard to
173 * create, so something is likely fishy and we
174 * should reject them altogether.
176 if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
177 if (seen_exclusive_status++)
178 goto error;
181 if (sigcheck_gpg_status[i].result)
182 sigc->result = sigcheck_gpg_status[i].result;
183 /* Do we have key information? */
184 if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
185 next = strchrnul(line, ' ');
186 replace_cstring(&sigc->key, line, next);
187 /* Do we have signer information? */
188 if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
189 line = next + 1;
190 next = strchrnul(line, '\n');
191 replace_cstring(&sigc->signer, line, next);
195 /* Do we have trust level? */
196 if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
198 * GPG v1 and v2 differs in how the
199 * TRUST_ lines are written. Some
200 * trust lines contain no additional
201 * space-separated information for v1.
203 size_t trust_size = strcspn(line, " \n");
204 char *trust = xmemdupz(line, trust_size);
206 if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
207 free(trust);
208 goto error;
210 free(trust);
213 /* Do we have fingerprint? */
214 if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
215 const char *limit;
216 char **field;
218 next = strchrnul(line, ' ');
219 replace_cstring(&sigc->fingerprint, line, next);
222 * Skip interim fields. The search is
223 * limited to the same line since only
224 * OpenPGP signatures has a field with
225 * the primary fingerprint.
227 limit = strchrnul(line, '\n');
228 for (j = 9; j > 0; j--) {
229 if (!*next || limit <= next)
230 break;
231 line = next + 1;
232 next = strchrnul(line, ' ');
235 field = &sigc->primary_key_fingerprint;
236 if (!j) {
237 next = strchrnul(line, '\n');
238 replace_cstring(field, line, next);
239 } else {
240 replace_cstring(field, NULL, NULL);
244 break;
248 return;
250 error:
251 sigc->result = 'E';
252 /* Clear partial data to avoid confusion */
253 FREE_AND_NULL(sigc->primary_key_fingerprint);
254 FREE_AND_NULL(sigc->fingerprint);
255 FREE_AND_NULL(sigc->signer);
256 FREE_AND_NULL(sigc->key);
259 static int verify_signed_buffer(const char *payload, size_t payload_size,
260 const char *signature, size_t signature_size,
261 struct strbuf *gpg_output,
262 struct strbuf *gpg_status)
264 struct child_process gpg = CHILD_PROCESS_INIT;
265 struct gpg_format *fmt;
266 struct tempfile *temp;
267 int ret;
268 struct strbuf buf = STRBUF_INIT;
270 temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
271 if (!temp)
272 return error_errno(_("could not create temporary file"));
273 if (write_in_full(temp->fd, signature, signature_size) < 0 ||
274 close_tempfile_gently(temp) < 0) {
275 error_errno(_("failed writing detached signature to '%s'"),
276 temp->filename.buf);
277 delete_tempfile(&temp);
278 return -1;
281 fmt = get_format_by_sig(signature);
282 if (!fmt)
283 BUG("bad signature '%s'", signature);
285 argv_array_push(&gpg.args, fmt->program);
286 argv_array_pushv(&gpg.args, fmt->verify_args);
287 argv_array_pushl(&gpg.args,
288 "--status-fd=1",
289 "--verify", temp->filename.buf, "-",
290 NULL);
292 if (!gpg_status)
293 gpg_status = &buf;
295 sigchain_push(SIGPIPE, SIG_IGN);
296 ret = pipe_command(&gpg, payload, payload_size,
297 gpg_status, 0, gpg_output, 0);
298 sigchain_pop(SIGPIPE);
300 delete_tempfile(&temp);
302 ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
303 strbuf_release(&buf); /* no matter it was used or not */
305 return ret;
308 int check_signature(const char *payload, size_t plen, const char *signature,
309 size_t slen, struct signature_check *sigc)
311 struct strbuf gpg_output = STRBUF_INIT;
312 struct strbuf gpg_status = STRBUF_INIT;
313 int status;
315 sigc->result = 'N';
316 sigc->trust_level = -1;
318 status = verify_signed_buffer(payload, plen, signature, slen,
319 &gpg_output, &gpg_status);
320 if (status && !gpg_output.len)
321 goto out;
322 sigc->payload = xmemdupz(payload, plen);
323 sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
324 sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
325 parse_gpg_output(sigc);
326 status |= sigc->result != 'G';
327 status |= sigc->trust_level < configured_min_trust_level;
329 out:
330 strbuf_release(&gpg_status);
331 strbuf_release(&gpg_output);
333 return !!status;
336 void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
338 const char *output = flags & GPG_VERIFY_RAW ?
339 sigc->gpg_status : sigc->gpg_output;
341 if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
342 fputs(sigc->payload, stdout);
344 if (output)
345 fputs(output, stderr);
348 size_t parse_signature(const char *buf, size_t size)
350 size_t len = 0;
351 size_t match = size;
352 while (len < size) {
353 const char *eol;
355 if (get_format_by_sig(buf + len))
356 match = len;
358 eol = memchr(buf + len, '\n', size - len);
359 len += eol ? eol - (buf + len) + 1 : size - len;
361 return match;
364 void set_signing_key(const char *key)
366 free(configured_signing_key);
367 configured_signing_key = xstrdup(key);
370 int git_gpg_config(const char *var, const char *value, void *cb)
372 struct gpg_format *fmt = NULL;
373 char *fmtname = NULL;
374 char *trust;
375 int ret;
377 if (!strcmp(var, "user.signingkey")) {
378 if (!value)
379 return config_error_nonbool(var);
380 set_signing_key(value);
381 return 0;
384 if (!strcmp(var, "gpg.format")) {
385 if (!value)
386 return config_error_nonbool(var);
387 fmt = get_format_by_name(value);
388 if (!fmt)
389 return error("unsupported value for %s: %s",
390 var, value);
391 use_format = fmt;
392 return 0;
395 if (!strcmp(var, "gpg.mintrustlevel")) {
396 if (!value)
397 return config_error_nonbool(var);
399 trust = xstrdup_toupper(value);
400 ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
401 free(trust);
403 if (ret)
404 return error("unsupported value for %s: %s", var,
405 value);
406 return 0;
409 if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
410 fmtname = "openpgp";
412 if (!strcmp(var, "gpg.x509.program"))
413 fmtname = "x509";
415 if (fmtname) {
416 fmt = get_format_by_name(fmtname);
417 return git_config_string(&fmt->program, var, value);
420 return 0;
423 const char *get_signing_key(void)
425 if (configured_signing_key)
426 return configured_signing_key;
427 return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
430 int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
432 struct child_process gpg = CHILD_PROCESS_INIT;
433 int ret;
434 size_t i, j, bottom;
435 struct strbuf gpg_status = STRBUF_INIT;
437 argv_array_pushl(&gpg.args,
438 use_format->program,
439 "--status-fd=2",
440 "-bsau", signing_key,
441 NULL);
443 bottom = signature->len;
446 * When the username signingkey is bad, program could be terminated
447 * because gpg exits without reading and then write gets SIGPIPE.
449 sigchain_push(SIGPIPE, SIG_IGN);
450 ret = pipe_command(&gpg, buffer->buf, buffer->len,
451 signature, 1024, &gpg_status, 0);
452 sigchain_pop(SIGPIPE);
454 ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
455 strbuf_release(&gpg_status);
456 if (ret)
457 return error(_("gpg failed to sign the data"));
459 /* Strip CR from the line endings, in case we are on Windows. */
460 for (i = j = bottom; i < signature->len; i++)
461 if (signature->buf[i] != '\r') {
462 if (i != j)
463 signature->buf[j] = signature->buf[i];
464 j++;
466 strbuf_setlen(signature, j);
468 return 0;