t/lib-gpg.sh

   1 # We always set GNUPGHOME, even if no usable GPG was found, as
   2 #
   3 # - It does not hurt, and
   4 #
   5 # - we cannot set global environment variables in lazy prereqs because they are
   6 #   executed in an eval'ed subshell that changes the working directory to a
   7 #   temporary one.
   8
   9 GNUPGHOME="$PWD/gpghome"
  10 export GNUPGHOME
  11
  12 test_lazy_prereq GPG '
  13         gpg_version=$(gpg --version 2>&1)
  14         test $? != 127 || exit 1
  15
  16         # As said here: http://www.gnupg.org/documentation/faqs.html#q6.19
  17         # the gpg version 1.0.6 did not parse trust packets correctly, so for
  18         # that version, creation of signed tags using the generated key fails.
  19         case "$gpg_version" in
  20         "gpg (GnuPG) 1.0.6"*)
  21                 say "Your version of gpg (1.0.6) is too buggy for testing"
  22                 exit 1
  23                 ;;
  24         *)
  25                 # Available key info:
  26                 # * Type DSA and Elgamal, size 2048 bits, no expiration date,
  27                 #   name and email: C O Mitter <committer@example.com>
  28                 # * Type RSA, size 2048 bits, no expiration date,
  29                 #   name and email: Eris Discordia <discord@example.net>
  30                 # No password given, to enable non-interactive operation.
  31                 # To generate new key:
  32                 #       gpg --homedir /tmp/gpghome --gen-key
  33                 # To write armored exported key to keyring:
  34                 #       gpg --homedir /tmp/gpghome --export-secret-keys \
  35                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  36                 #       gpg --homedir /tmp/gpghome --export \
  37                 #               --armor 0xDEADBEEF >> lib-gpg/keyring.gpg
  38                 # To export ownertrust:
  39                 #       gpg --homedir /tmp/gpghome --export-ownertrust \
  40                 #               > lib-gpg/ownertrust
  41                 mkdir "$GNUPGHOME" &&
  42                 chmod 0700 "$GNUPGHOME" &&
  43                 (gpgconf --kill gpg-agent || : ) &&
  44                 gpg --homedir "${GNUPGHOME}" --import \
  45                         "$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
  46                 gpg --homedir "${GNUPGHOME}" --import-ownertrust \
  47                         "$TEST_DIRECTORY"/lib-gpg/ownertrust &&
  48                 gpg --homedir "${GNUPGHOME}" </dev/null >/dev/null \
  49                         --sign -u committer@example.com
  50                 ;;
  51         esac
  52 '
  53
  54 test_lazy_prereq GPGSM '
  55         test_have_prereq GPG &&
  56         # Available key info:
  57         # * see t/lib-gpg/gpgsm-gen-key.in
  58         # To generate new certificate:
  59         #  * no passphrase
  60         #       gpgsm --homedir /tmp/gpghome/ \
  61         #               -o /tmp/gpgsm.crt.user \
  62         #               --generate-key \
  63         #               --batch t/lib-gpg/gpgsm-gen-key.in
  64         # To import certificate:
  65         #       gpgsm --homedir /tmp/gpghome/ \
  66         #               --import /tmp/gpgsm.crt.user
  67         # To export into a .p12 we can later import:
  68         #       gpgsm --homedir /tmp/gpghome/ \
  69         #               -o t/lib-gpg/gpgsm_cert.p12 \
  70         #               --export-secret-key-p12 "committer@example.com"
  71         echo | gpgsm --homedir "${GNUPGHOME}" \
  72                 --passphrase-fd 0 --pinentry-mode loopback \
  73                 --import "$TEST_DIRECTORY"/lib-gpg/gpgsm_cert.p12 &&
  74
  75         gpgsm --homedir "${GNUPGHOME}" -K |
  76         grep fingerprint: |
  77         cut -d" " -f4 |
  78         tr -d "\\n" >"${GNUPGHOME}/trustlist.txt" &&
  79
  80         echo " S relax" >>"${GNUPGHOME}/trustlist.txt" &&
  81         echo hello | gpgsm --homedir "${GNUPGHOME}" >/dev/null \
  82                -u committer@example.com -o /dev/null --sign -
  83 '
  84
  85 test_lazy_prereq RFC1991 '
  86         test_have_prereq GPG &&
  87         echo | gpg --homedir "${GNUPGHOME}" -b --rfc1991 >/dev/null
  88 '
  89
  90 GPGSSH_KEY_PRIMARY="${GNUPGHOME}/ed25519_ssh_signing_key"
  91 GPGSSH_KEY_SECONDARY="${GNUPGHOME}/rsa_2048_ssh_signing_key"
  92 GPGSSH_KEY_UNTRUSTED="${GNUPGHOME}/untrusted_ssh_signing_key"
  93 GPGSSH_KEY_EXPIRED="${GNUPGHOME}/expired_ssh_signing_key"
  94 GPGSSH_KEY_NOTYETVALID="${GNUPGHOME}/notyetvalid_ssh_signing_key"
  95 GPGSSH_KEY_TIMEBOXEDVALID="${GNUPGHOME}/timeboxed_valid_ssh_signing_key"
  96 GPGSSH_KEY_TIMEBOXEDINVALID="${GNUPGHOME}/timeboxed_invalid_ssh_signing_key"
  97 GPGSSH_KEY_WITH_PASSPHRASE="${GNUPGHOME}/protected_ssh_signing_key"
  98 GPGSSH_KEY_ECDSA="${GNUPGHOME}/ecdsa_ssh_signing_key"
  99 GPGSSH_KEY_PASSPHRASE="super_secret"
 100 GPGSSH_ALLOWED_SIGNERS="${GNUPGHOME}/ssh.all_valid.allowedSignersFile"
 101
 102 GPGSSH_GOOD_SIGNATURE_TRUSTED='Good "git" signature for'
 103 GPGSSH_GOOD_SIGNATURE_UNTRUSTED='Good "git" signature with'
 104 GPGSSH_KEY_NOT_TRUSTED="No principal matched"
 105 GPGSSH_BAD_SIGNATURE="Signature verification failed"
 106
 107 test_lazy_prereq GPGSSH '
 108         ssh_version=$(ssh-keygen -Y find-principals -n "git" 2>&1)
 109         test $? != 127 || exit 1
 110         echo $ssh_version | grep -q "find-principals:missing signature file"
 111         test $? = 0 || exit 1;
 112
 113         # Setup some keys and an allowed signers file
 114         mkdir -p "${GNUPGHOME}" &&
 115         chmod 0700 "${GNUPGHOME}" &&
 116         (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
 117         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
 118         ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
 119         ssh-keygen -t ed25519 -N "${GPGSSH_KEY_PASSPHRASE}" -C "git ed25519 encrypted key" -f "${GPGSSH_KEY_WITH_PASSPHRASE}" >/dev/null &&
 120         ssh-keygen -t ecdsa -N "" -f "${GPGSSH_KEY_ECDSA}" >/dev/null &&
 121         ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_UNTRUSTED}" >/dev/null &&
 122
 123         cat >"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 124         "principal with number 1" $(cat "${GPGSSH_KEY_PRIMARY}.pub")"
 125         "principal with number 2" $(cat "${GPGSSH_KEY_SECONDARY}.pub")"
 126         "principal with number 3" $(cat "${GPGSSH_KEY_WITH_PASSPHRASE}.pub")"
 127         "principal with number 4" $(cat "${GPGSSH_KEY_ECDSA}.pub")"
 128         EOF
 129
 130         # Verify if at least one key and ssh-keygen works as expected
 131         echo "testpayload" |
 132         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_PRIMARY}" >gpgssh_prereq.sig &&
 133         ssh-keygen -Y find-principals -f "${GPGSSH_ALLOWED_SIGNERS}" -s gpgssh_prereq.sig &&
 134         echo "testpayload" |
 135         ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with number 1" -s gpgssh_prereq.sig
 136 '
 137
 138 test_lazy_prereq GPGSSH_VERIFYTIME '
 139         # Check if ssh-keygen has a verify-time option by passing an invalid date to it
 140         ssh-keygen -Overify-time=INVALID -Y check-novalidate -s doesnotmatter 2>&1 | grep -q -F "Invalid \"verify-time\"" &&
 141
 142         # Set up keys with key lifetimes
 143         ssh-keygen -t ed25519 -N "" -C "timeboxed valid key" -f "${GPGSSH_KEY_TIMEBOXEDVALID}" >/dev/null &&
 144         key_valid=$(cat "${GPGSSH_KEY_TIMEBOXEDVALID}.pub") &&
 145         ssh-keygen -t ed25519 -N "" -C "timeboxed invalid key" -f "${GPGSSH_KEY_TIMEBOXEDINVALID}" >/dev/null &&
 146         key_invalid=$(cat "${GPGSSH_KEY_TIMEBOXEDINVALID}.pub") &&
 147         ssh-keygen -t ed25519 -N "" -C "expired key" -f "${GPGSSH_KEY_EXPIRED}" >/dev/null &&
 148         key_expired=$(cat "${GPGSSH_KEY_EXPIRED}.pub") &&
 149         ssh-keygen -t ed25519 -N "" -C "not yet valid key" -f "${GPGSSH_KEY_NOTYETVALID}" >/dev/null &&
 150         key_notyetvalid=$(cat "${GPGSSH_KEY_NOTYETVALID}.pub") &&
 151
 152         # Timestamps outside of test_tick span
 153         ts2005a=20050401000000 ts2005b=200504020000 &&
 154         # Timestamps within test_tick span
 155         ts2005c=20050407000000 ts2005d=200504100000 &&
 156         # Definitely not yet valid / expired timestamps
 157         ts2000=20000101000000 ts2999=29990101000000 &&
 158
 159         cat >>"${GPGSSH_ALLOWED_SIGNERS}" <<-EOF &&
 160         "timeboxed valid key" valid-after="$ts2005c",valid-before="$ts2005d" $key_valid"
 161         "timeboxed invalid key" valid-after="$ts2005a",valid-before="$ts2005b" $key_invalid"
 162         "principal with expired key" valid-before="$ts2000" $key_expired"
 163         "principal with not yet valid key" valid-after="$ts2999" $key_notyetvalid"
 164         EOF
 165
 166         # and verify ssh-keygen verifies the key lifetime
 167         echo "testpayload" |
 168         ssh-keygen -Y sign -n "git" -f "${GPGSSH_KEY_EXPIRED}" >gpgssh_verifytime_prereq.sig &&
 169         ! (ssh-keygen -Y verify -n "git" -f "${GPGSSH_ALLOWED_SIGNERS}" -I "principal with expired key" -s gpgssh_verifytime_prereq.sig)
 170 '
 171
 172 sanitize_pgp() {
 173         perl -ne '
 174                 /^-----END PGP/ and $in_pgp = 0;
 175                 print unless $in_pgp;
 176                 /^-----BEGIN PGP/ and $in_pgp = 1;
 177         '
 178 }