Skip to content

Commit 3deb97f

Browse files
gitstergitster
committed
Merge branch 'cc/fast-import-strip-signed-tags'
"git fast-import" is taught to handle signed tags, just like it recently learned to handle signed commits, in different ways. * cc/fast-import-strip-signed-tags: fast-import: add '--signed-tags=<mode>' option fast-export: handle all kinds of tag signatures t9350: properly count annotated tags lib-gpg: allow tests with GPGSM or GPGSSH prereq first doc: git-tag: stop focusing on GPG signed tags
2 parents 54ac380 + d8ce08a commit 3deb97f

File tree

8 files changed

+229
-27
lines changed

8 files changed

+229
-27
lines changed

‎Documentation/git-fast-import.adoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,11 @@ fast-import stream! This option is enabled automatically for
6666
remote-helpers that use the `import` capability, as they are
6767
already trusted to run their own code.
6868

69+
--signed-tags=(verbatim|warn-verbatim|warn-strip|strip|abort)::
70+
Specify how to handle signed tags. Behaves in the same way
71+
as the same option in linkgit:git-fast-export[1], except that
72+
default is 'verbatim' (instead of 'abort').
73+
6974
--signed-commits=(verbatim|warn-verbatim|warn-strip|strip|abort)::
7075
Specify how to handle signed commits. Behaves in the same way
7176
as the same option in linkgit:git-fast-export[1], except that

‎Documentation/git-tag.adoc‎

Lines changed: 33 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ git-tag(1)
33

44
NAME
55
----
6-
git-tag - Create, list, delete or verify a tag object signed with GPG
6+
git-tag - Create, list, delete or verify tags
77

88

99
SYNOPSIS
@@ -38,15 +38,17 @@ and `-a`, `-s`, and `-u <key-id>` are absent, `-a` is implied.
3838
Otherwise, a tag reference that points directly at the given object
3939
(i.e., a lightweight tag) is created.
4040

41-
A GnuPG signed tag object will be created when `-s` or `-u
42-
<key-id>` is used. When `-u <key-id>` is not used, the
43-
committer identity for the current user is used to find the
44-
GnuPG key for signing. The configuration variable `gpg.program`
45-
is used to specify custom GnuPG binary.
41+
A cryptographically signed tag object will be created when `-s` or
42+
`-u <key-id>` is used. The signing backend (GPG, X.509, SSH, etc.) is
43+
controlled by the `gpg.format` configuration variable, defaulting to
44+
OpenPGP. When `-u <key-id>` is not used, the committer identity for
45+
the current user is used to find the key for signing. The
46+
configuration variable `gpg.program` is used to specify a custom
47+
signing binary.
4648

4749
Tag objects (created with `-a`, `-s`, or `-u`) are called "annotated"
4850
tags; they contain a creation date, the tagger name and e-mail, a
49-
tagging message, and an optional GnuPG signature. Whereas a
51+
tagging message, and an optional cryptographic signature. Whereas a
5052
"lightweight" tag is simply a name for an object (usually a commit
5153
object).
5254

@@ -64,18 +66,23 @@ OPTIONS
6466

6567
`-s`::
6668
`--sign`::
67-
Make a GPG-signed tag, using the default e-mail address's key.
68-
The default behavior of tag GPG-signing is controlled by `tag.gpgSign`
69-
configuration variable if it exists, or disabled otherwise.
70-
See linkgit:git-config[1].
69+
Make a cryptographically signed tag, using the default signing
70+
key. The signing backend used depends on the `gpg.format`
71+
configuration variable. The default key is determined by the
72+
backend. For GPG, it's based on the committer's email address,
73+
while for SSH it may be a specific key file or agent
74+
identity. See linkgit:git-config[1].
7175

7276
`--no-sign`::
7377
Override `tag.gpgSign` configuration variable that is
7478
set to force each and every tag to be signed.
7579

7680
`-u <key-id>`::
7781
`--local-user=<key-id>`::
78-
Make a GPG-signed tag, using the given key.
82+
Make a cryptographically signed tag using the given key. The
83+
format of the <key-id> and the backend used depend on the
84+
`gpg.format` configuration variable. See
85+
linkgit:git-config[1].
7986

8087
`-f`::
8188
`--force`::
@@ -87,7 +94,7 @@ OPTIONS
8794

8895
`-v`::
8996
`--verify`::
90-
Verify the GPG signature of the given tag names.
97+
Verify the cryptographic signature of the given tags.
9198

9299
`-n<num>`::
93100
_<num>_ specifies how many lines from the annotation, if any,
@@ -235,12 +242,23 @@ it in the repository configuration as follows:
235242

236243
-------------------------------------
237244
[user]
238-
signingKey = <gpg-key-id>
245+
signingKey = <key-id>
239246
-------------------------------------
240247

248+
The signing backend can be chosen via the `gpg.format` configuration
249+
variable, which defaults to `openpgp`. See linkgit:git-config[1]
250+
for a list of other supported formats.
251+
252+
The path to the program used for each signing backend can be specified
253+
with the `gpg.<format>.program` configuration variable. For the
254+
`openpgp` backend, `gpg.program` can be used as a synonym for
255+
`gpg.openpgp.program`. See linkgit:git-config[1] for details.
256+
241257
`pager.tag` is only respected when listing tags, i.e., when `-l` is
242258
used or implied. The default is to use a pager.
243-
See linkgit:git-config[1].
259+
260+
See linkgit:git-config[1] for more details and other configuration
261+
variables.
244262

245263
DISCUSSION
246264
----------

‎builtin/fast-export.c‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -931,9 +931,8 @@ static void handle_tag(const char *name, struct tag *tag)
931931

932932
/* handle signed tags */
933933
if (message) {
934-
const char *signature = strstr(message,
935-
"\n-----BEGIN PGP SIGNATURE-----\n");
936-
if (signature)
934+
size_t sig_offset = parse_signed_buffer(message, message_size);
935+
if (sig_offset < message_size)
937936
switch (signed_tag_mode) {
938937
case SIGN_ABORT:
939938
die("encountered signed tag %s; use "
@@ -950,7 +949,7 @@ static void handle_tag(const char *name, struct tag *tag)
950949
oid_to_hex(&tag->object.oid));
951950
/* fallthru */
952951
case SIGN_STRIP:
953-
message_size = signature + 1 - message;
952+
message_size = sig_offset;
954953
break;
955954
}
956955
}

‎builtin/fast-import.c‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ static int global_argc;
188188
static const char **global_argv;
189189
static const char *global_prefix;
190190

191+
static enum sign_mode signed_tag_mode = SIGN_VERBATIM;
191192
static enum sign_mode signed_commit_mode = SIGN_VERBATIM;
192193

193194
/* Memory pools */
@@ -2963,6 +2964,43 @@ static void parse_new_commit(const char *arg)
29632964
b->last_commit = object_count_by_type[OBJ_COMMIT];
29642965
}
29652966

2967+
static void handle_tag_signature(struct strbuf *msg, const char *name)
2968+
{
2969+
size_t sig_offset = parse_signed_buffer(msg->buf, msg->len);
2970+
2971+
/* If there is no signature, there is nothing to do. */
2972+
if (sig_offset >= msg->len)
2973+
return;
2974+
2975+
switch (signed_tag_mode) {
2976+
2977+
/* First, modes that don't change anything */
2978+
case SIGN_ABORT:
2979+
die(_("encountered signed tag; use "
2980+
"--signed-tags=<mode> to handle it"));
2981+
case SIGN_WARN_VERBATIM:
2982+
warning(_("importing a tag signature verbatim for tag '%s'"), name);
2983+
/* fallthru */
2984+
case SIGN_VERBATIM:
2985+
/* Nothing to do, the signature will be put into the imported tag. */
2986+
break;
2987+
2988+
/* Second, modes that remove the signature */
2989+
case SIGN_WARN_STRIP:
2990+
warning(_("stripping a tag signature for tag '%s'"), name);
2991+
/* fallthru */
2992+
case SIGN_STRIP:
2993+
/* Truncate the buffer to remove the signature */
2994+
strbuf_setlen(msg, sig_offset);
2995+
break;
2996+
2997+
/* Third, BUG */
2998+
default:
2999+
BUG("invalid signed_tag_mode value %d from tag '%s'",
3000+
signed_tag_mode, name);
3001+
}
3002+
}
3003+
29663004
static void parse_new_tag(const char *arg)
29673005
{
29683006
static struct strbuf msg = STRBUF_INIT;
@@ -3026,6 +3064,8 @@ static void parse_new_tag(const char *arg)
30263064
/* tag payload/message */
30273065
parse_data(&msg, 0, NULL);
30283066

3067+
handle_tag_signature(&msg, t->name);
3068+
30293069
/* build the tag object */
30303070
strbuf_reset(&new_data);
30313071

@@ -3546,6 +3586,9 @@ static int parse_one_option(const char *option)
35463586
} else if (skip_prefix(option, "signed-commits=", &option)) {
35473587
if (parse_sign_mode(option, &signed_commit_mode))
35483588
usagef(_("unknown --signed-commits mode '%s'"), option);
3589+
} else if (skip_prefix(option, "signed-tags=", &option)) {
3590+
if (parse_sign_mode(option, &signed_tag_mode))
3591+
usagef(_("unknown --signed-tags mode '%s'"), option);
35493592
} else if (!strcmp(option, "quiet")) {
35503593
show_stats = 0;
35513594
quiet = 1;

‎t/lib-gpg.sh‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@
99
GNUPGHOME="$(pwd)/gpghome"
1010
export GNUPGHOME
1111

12+
# All the "test_lazy_prereq GPG*" below should use
13+
# `prepare_gnupghome()` either directly or through a call to
14+
# `test_have_prereq GPG*`. That's because `gpg` and `gpgsm`
15+
# only create the directory specified using "$GNUPGHOME" or
16+
# `--homedir` if it's the default (usually "~/.gnupg").
17+
prepare_gnupghome() {
18+
mkdir -p "$GNUPGHOME" &&
19+
chmod 0700 "$GNUPGHOME"
20+
}
21+
1222
test_lazy_prereq GPG '
1323
gpg_version=$(gpg --version 2>&1)
1424
test $? != 127 || exit 1
@@ -38,8 +48,7 @@ test_lazy_prereq GPG '
3848
# To export ownertrust:
3949
# gpg --homedir /tmp/gpghome --export-ownertrust \
4050
# > lib-gpg/ownertrust
41-
mkdir "$GNUPGHOME" &&
42-
chmod 0700 "$GNUPGHOME" &&
51+
prepare_gnupghome &&
4352
(gpgconf --kill all || : ) &&
4453
gpg --homedir "${GNUPGHOME}" --import \
4554
"$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
@@ -63,6 +72,14 @@ test_lazy_prereq GPG2 '
6372
;;
6473
*)
6574
(gpgconf --kill all || : ) &&
75+
76+
# NEEDSWORK: prepare_gnupghome() should definitely be
77+
# called here, but it looks like it exposes a
78+
# pre-existing, hidden bug by allowing some tests in
79+
# t1016-compatObjectFormat.sh to run instead of being
80+
# skipped. See:
81+
# https://lore.kernel.org/git/[email protected]/
82+
6683
gpg --homedir "${GNUPGHOME}" --import \
6784
"$TEST_DIRECTORY"/lib-gpg/keyring.gpg &&
6885
gpg --homedir "${GNUPGHOME}" --import-ownertrust \
@@ -132,8 +149,7 @@ test_lazy_prereq GPGSSH '
132149
test $? = 0 || exit 1;
133150
134151
# Setup some keys and an allowed signers file
135-
mkdir -p "${GNUPGHOME}" &&
136-
chmod 0700 "${GNUPGHOME}" &&
152+
prepare_gnupghome &&
137153
(setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
138154
ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
139155
ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&

‎t/meson.build‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1037,6 +1037,7 @@ integration_tests = [
10371037
't9303-fast-import-compression.sh',
10381038
't9304-fast-import-marks.sh',
10391039
't9305-fast-import-signatures.sh',
1040+
't9306-fast-import-signed-tags.sh',
10401041
't9350-fast-export.sh',
10411042
't9351-fast-export-anonymize.sh',
10421043
't9400-git-cvsserver-server.sh',

‎t/t9306-fast-import-signed-tags.sh‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
#!/bin/sh
2+
3+
test_description='git fast-import --signed-tags=<mode>'
4+
5+
GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
6+
7+
. ./test-lib.sh
8+
. "$TEST_DIRECTORY/lib-gpg.sh"
9+
10+
test_expect_success 'set up unsigned initial commit and import repo' '
11+
test_commit first &&
12+
git init new
13+
'
14+
15+
test_expect_success 'import no signed tag with --signed-tags=abort' '
16+
git fast-export --signed-tags=verbatim >output &&
17+
git -C new fast-import --quiet --signed-tags=abort <output
18+
'
19+
20+
test_expect_success GPG 'set up OpenPGP signed tag' '
21+
git tag -s -m "OpenPGP signed tag" openpgp-signed first &&
22+
OPENPGP_SIGNED=$(git rev-parse --verify refs/tags/openpgp-signed) &&
23+
git fast-export --signed-tags=verbatim openpgp-signed >output
24+
'
25+
26+
test_expect_success GPG 'import OpenPGP signed tag with --signed-tags=abort' '
27+
test_must_fail git -C new fast-import --quiet --signed-tags=abort <output
28+
'
29+
30+
test_expect_success GPG 'import OpenPGP signed tag with --signed-tags=verbatim' '
31+
git -C new fast-import --quiet --signed-tags=verbatim <output >log 2>&1 &&
32+
IMPORTED=$(git -C new rev-parse --verify refs/tags/openpgp-signed) &&
33+
test $OPENPGP_SIGNED = $IMPORTED &&
34+
test_must_be_empty log
35+
'
36+
37+
test_expect_success GPGSM 'setup X.509 signed tag' '
38+
test_config gpg.format x509 &&
39+
test_config user.signingkey $GIT_COMMITTER_EMAIL &&
40+
41+
git tag -s -m "X.509 signed tag" x509-signed first &&
42+
X509_SIGNED=$(git rev-parse --verify refs/tags/x509-signed) &&
43+
git fast-export --signed-tags=verbatim x509-signed >output
44+
'
45+
46+
test_expect_success GPGSM 'import X.509 signed tag with --signed-tags=warn-strip' '
47+
git -C new fast-import --quiet --signed-tags=warn-strip <output >log 2>&1 &&
48+
test_grep "stripping a tag signature for tag '\''x509-signed'\''" log &&
49+
IMPORTED=$(git -C new rev-parse --verify refs/tags/x509-signed) &&
50+
test $X509_SIGNED != $IMPORTED &&
51+
git -C new cat-file -p x509-signed >out &&
52+
test_grep ! "SIGNED MESSAGE" out
53+
'
54+
55+
test_expect_success GPGSSH 'setup SSH signed tag' '
56+
test_config gpg.format ssh &&
57+
test_config user.signingkey "${GPGSSH_KEY_PRIMARY}" &&
58+
59+
git tag -s -m "SSH signed tag" ssh-signed first &&
60+
SSH_SIGNED=$(git rev-parse --verify refs/tags/ssh-signed) &&
61+
git fast-export --signed-tags=verbatim ssh-signed >output
62+
'
63+
64+
test_expect_success GPGSSH 'import SSH signed tag with --signed-tags=warn-verbatim' '
65+
git -C new fast-import --quiet --signed-tags=warn-verbatim <output >log 2>&1 &&
66+
test_grep "importing a tag signature verbatim for tag '\''ssh-signed'\''" log &&
67+
IMPORTED=$(git -C new rev-parse --verify refs/tags/ssh-signed) &&
68+
test $SSH_SIGNED = $IMPORTED
69+
'
70+
71+
test_expect_success GPGSSH 'import SSH signed tag with --signed-tags=strip' '
72+
git -C new fast-import --quiet --signed-tags=strip <output >log 2>&1 &&
73+
test_must_be_empty log &&
74+
IMPORTED=$(git -C new rev-parse --verify refs/tags/ssh-signed) &&
75+
test $SSH_SIGNED != $IMPORTED &&
76+
git -C new cat-file -p ssh-signed >out &&
77+
test_grep ! "SSH SIGNATURE" out
78+
'
79+
80+
test_done

0 commit comments

Comments
 (0)