blob: 5c824aeb257cb94ccb16297e17fa00df973fd36c [file] [log] [blame]
Elijah Newrena64acf72023-03-21 06:26:02 +00001#include "git-compat-util.h"
brian m. carlson9b27b492021-02-11 02:08:06 +00002#include "commit.h"
Brandon Williamsb2141fc2017-06-14 11:07:36 -07003#include "config.h"
Elijah Newrend4a4f922023-04-22 20:17:26 +00004#include "date.h"
Elijah Newrenf394e092023-03-21 06:25:54 +00005#include "gettext.h"
Junio C Hamano2f47eae2011-09-07 21:19:47 -07006#include "run-command.h"
7#include "strbuf.h"
Fabian Stelzerfacca532021-09-10 20:07:39 +00008#include "dir.h"
Elijah Newrenb5fa6082023-02-24 00:09:29 +00009#include "ident.h"
Junio C Hamano2f47eae2011-09-07 21:19:47 -070010#include "gpg-interface.h"
Elijah Newrend1cbe1e2023-04-22 20:17:20 +000011#include "path.h"
Junio C Hamano2f47eae2011-09-07 21:19:47 -070012#include "sigchain.h"
Jeff King43223532016-06-17 19:38:43 -040013#include "tempfile.h"
Fabian Stelzerfd9e2262021-09-10 20:07:37 +000014#include "alias.h"
Junio C Hamano2f47eae2011-09-07 21:19:47 -070015
Glen Chooa4e7e312023-06-28 19:26:22 +000016static int git_gpg_config(const char *, const char *,
17 const struct config_context *, void *);
Junio C Hamanofd2d4c12023-02-09 12:24:14 -080018
19static void gpg_interface_lazy_init(void)
20{
21 static int done;
22
23 if (done)
24 return;
25 done = 1;
26 git_config(git_gpg_config, NULL);
27}
28
Junio C Hamano2f47eae2011-09-07 21:19:47 -070029static char *configured_signing_key;
Patrick Steinhardt1b261c22024-05-27 13:46:39 +020030static char *ssh_default_key_command;
Patrick Steinhardt6073b3b2024-05-27 13:46:15 +020031static char *ssh_allowed_signers;
32static char *ssh_revocation_file;
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +000033static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;
34
Henning Schild58af57e2018-07-17 14:50:09 +020035struct gpg_format {
36 const char *name;
Patrick Steinhardtc113c5d2024-06-07 08:37:43 +020037 const char *program;
Henning Schild58af57e2018-07-17 14:50:09 +020038 const char **verify_args;
39 const char **sigs;
Fabian Stelzerb5726a52021-09-10 20:07:34 +000040 int (*verify_signed_buffer)(struct signature_check *sigc,
Fabian Stelzer02769432021-12-09 09:52:43 +010041 struct gpg_format *fmt,
42 const char *signature,
Fabian Stelzerb5726a52021-09-10 20:07:34 +000043 size_t signature_size);
44 int (*sign_buffer)(struct strbuf *buffer, struct strbuf *signature,
45 const char *signing_key);
Fabian Stelzerfd9e2262021-09-10 20:07:37 +000046 const char *(*get_default_key)(void);
Fabian Stelzer4838f622021-09-10 20:07:38 +000047 const char *(*get_key_id)(void);
Henning Schild58af57e2018-07-17 14:50:09 +020048};
Junio C Hamano2f47eae2011-09-07 21:19:47 -070049
Henning Schild58af57e2018-07-17 14:50:09 +020050static const char *openpgp_verify_args[] = {
51 "--keyid-format=long",
52 NULL
53};
54static const char *openpgp_sigs[] = {
55 "-----BEGIN PGP SIGNATURE-----",
56 "-----BEGIN PGP MESSAGE-----",
57 NULL
58};
59
Henning Schild1e7adb92018-07-17 14:50:12 +020060static const char *x509_verify_args[] = {
61 NULL
62};
63static const char *x509_sigs[] = {
64 "-----BEGIN SIGNED MESSAGE-----",
65 NULL
66};
67
Fabian Stelzer29b31572021-09-10 20:07:36 +000068static const char *ssh_verify_args[] = { NULL };
69static const char *ssh_sigs[] = {
70 "-----BEGIN SSH SIGNATURE-----",
71 NULL
72};
73
Fabian Stelzerb5726a52021-09-10 20:07:34 +000074static int verify_gpg_signed_buffer(struct signature_check *sigc,
Fabian Stelzer02769432021-12-09 09:52:43 +010075 struct gpg_format *fmt,
76 const char *signature,
Fabian Stelzerb5726a52021-09-10 20:07:34 +000077 size_t signature_size);
Fabian Stelzerfacca532021-09-10 20:07:39 +000078static int verify_ssh_signed_buffer(struct signature_check *sigc,
Fabian Stelzer02769432021-12-09 09:52:43 +010079 struct gpg_format *fmt,
80 const char *signature,
Fabian Stelzerfacca532021-09-10 20:07:39 +000081 size_t signature_size);
Fabian Stelzerb5726a52021-09-10 20:07:34 +000082static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
83 const char *signing_key);
Fabian Stelzer29b31572021-09-10 20:07:36 +000084static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
85 const char *signing_key);
Fabian Stelzerb5726a52021-09-10 20:07:34 +000086
Fabian Stelzerfd9e2262021-09-10 20:07:37 +000087static const char *get_default_ssh_signing_key(void);
88
Fabian Stelzer4838f622021-09-10 20:07:38 +000089static const char *get_ssh_key_id(void);
90
Henning Schild58af57e2018-07-17 14:50:09 +020091static struct gpg_format gpg_format[] = {
Fabian Stelzerb5726a52021-09-10 20:07:34 +000092 {
93 .name = "openpgp",
94 .program = "gpg",
95 .verify_args = openpgp_verify_args,
96 .sigs = openpgp_sigs,
97 .verify_signed_buffer = verify_gpg_signed_buffer,
98 .sign_buffer = sign_buffer_gpg,
Fabian Stelzerfd9e2262021-09-10 20:07:37 +000099 .get_default_key = NULL,
Fabian Stelzer4838f622021-09-10 20:07:38 +0000100 .get_key_id = NULL,
Henning Schild58af57e2018-07-17 14:50:09 +0200101 },
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000102 {
103 .name = "x509",
104 .program = "gpgsm",
105 .verify_args = x509_verify_args,
106 .sigs = x509_sigs,
107 .verify_signed_buffer = verify_gpg_signed_buffer,
108 .sign_buffer = sign_buffer_gpg,
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000109 .get_default_key = NULL,
Fabian Stelzer4838f622021-09-10 20:07:38 +0000110 .get_key_id = NULL,
Henning Schild1e7adb92018-07-17 14:50:12 +0200111 },
Fabian Stelzer29b31572021-09-10 20:07:36 +0000112 {
113 .name = "ssh",
114 .program = "ssh-keygen",
115 .verify_args = ssh_verify_args,
116 .sigs = ssh_sigs,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000117 .verify_signed_buffer = verify_ssh_signed_buffer,
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000118 .sign_buffer = sign_buffer_ssh,
119 .get_default_key = get_default_ssh_signing_key,
Fabian Stelzer4838f622021-09-10 20:07:38 +0000120 .get_key_id = get_ssh_key_id,
Fabian Stelzer29b31572021-09-10 20:07:36 +0000121 },
Henning Schild58af57e2018-07-17 14:50:09 +0200122};
123
124static struct gpg_format *use_format = &gpg_format[0];
125
126static struct gpg_format *get_format_by_name(const char *str)
127{
128 int i;
129
130 for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
131 if (!strcmp(gpg_format[i].name, str))
132 return gpg_format + i;
133 return NULL;
134}
135
136static struct gpg_format *get_format_by_sig(const char *sig)
137{
138 int i, j;
139
140 for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
141 for (j = 0; gpg_format[i].sigs[j]; j++)
142 if (starts_with(sig, gpg_format[i].sigs[j]))
143 return gpg_format + i;
144 return NULL;
145}
Junio C Hamanod7c67662014-08-19 13:18:07 -0700146
Michael J Gruber01e57b52014-06-23 09:05:47 +0200147void signature_check_clear(struct signature_check *sigc)
148{
Ævar Arnfjörð Bjarmason88ce3ef2017-06-15 23:15:49 +0000149 FREE_AND_NULL(sigc->payload);
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000150 FREE_AND_NULL(sigc->output);
Ævar Arnfjörð Bjarmason88ce3ef2017-06-15 23:15:49 +0000151 FREE_AND_NULL(sigc->gpg_status);
152 FREE_AND_NULL(sigc->signer);
153 FREE_AND_NULL(sigc->key);
Michał Górny3daaaab2018-10-22 18:38:20 +0200154 FREE_AND_NULL(sigc->fingerprint);
Michał Górny4de93942018-10-22 18:38:21 +0200155 FREE_AND_NULL(sigc->primary_key_fingerprint);
Michael J Gruber01e57b52014-06-23 09:05:47 +0200156}
157
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200158/* An exclusive status -- only one of them can appear in output */
159#define GPG_STATUS_EXCLUSIVE (1<<0)
Michał Górny0b11a842018-10-22 18:38:19 +0200160/* The status includes key identifier */
161#define GPG_STATUS_KEYID (1<<1)
162/* The status includes user identifier */
163#define GPG_STATUS_UID (1<<2)
Michał Górny3daaaab2018-10-22 18:38:20 +0200164/* The status includes key fingerprints */
165#define GPG_STATUS_FINGERPRINT (1<<3)
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000166/* The status includes trust level */
167#define GPG_STATUS_TRUST_LEVEL (1<<4)
Michał Górny0b11a842018-10-22 18:38:19 +0200168
169/* Short-hand for standard exclusive *SIG status with keyid & UID */
170#define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200171
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700172static struct {
173 char result;
174 const char *check;
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200175 unsigned int flags;
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700176} sigcheck_gpg_status[] = {
Michał Górny0b11a842018-10-22 18:38:19 +0200177 { 'G', "GOODSIG ", GPG_STATUS_STDSIG },
178 { 'B', "BADSIG ", GPG_STATUS_STDSIG },
Michał Górny0b11a842018-10-22 18:38:19 +0200179 { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID },
180 { 'X', "EXPSIG ", GPG_STATUS_STDSIG },
181 { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
182 { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
Michał Górny3daaaab2018-10-22 18:38:20 +0200183 { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000184 { 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
185};
186
Jaydeep Das803978d2022-07-11 05:00:50 +0000187/* Keep the order same as enum signature_trust_level */
188static struct sigcheck_gpg_trust_level {
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000189 const char *key;
Jaydeep Das803978d2022-07-11 05:00:50 +0000190 const char *display_key;
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000191 enum signature_trust_level value;
192} sigcheck_gpg_trust_level[] = {
Jaydeep Das803978d2022-07-11 05:00:50 +0000193 { "UNDEFINED", "undefined", TRUST_UNDEFINED },
194 { "NEVER", "never", TRUST_NEVER },
195 { "MARGINAL", "marginal", TRUST_MARGINAL },
196 { "FULLY", "fully", TRUST_FULLY },
197 { "ULTIMATE", "ultimate", TRUST_ULTIMATE },
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700198};
199
Hans Jerry Illikainen392b8622019-11-21 23:43:35 +0000200static void replace_cstring(char **field, const char *line, const char *next)
201{
202 free(*field);
203
204 if (line && next)
205 *field = xmemdupz(line, next - line);
206 else
207 *field = NULL;
208}
209
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000210static int parse_gpg_trust_level(const char *level,
211 enum signature_trust_level *res)
212{
213 size_t i;
214
215 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
216 if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
217 *res = sigcheck_gpg_trust_level[i].value;
218 return 0;
219 }
220 }
221 return 1;
222}
223
Henning Schildfbd0f162018-07-11 10:38:25 +0200224static void parse_gpg_output(struct signature_check *sigc)
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700225{
226 const char *buf = sigc->gpg_status;
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200227 const char *line, *next;
Michał Górny4de93942018-10-22 18:38:21 +0200228 int i, j;
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200229 int seen_exclusive_status = 0;
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700230
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200231 /* Iterate over all lines */
232 for (line = buf; *line; line = strchrnul(line+1, '\n')) {
233 while (*line == '\n')
234 line++;
Steven Roberts64c45dc2019-07-16 11:47:37 -0700235 if (!*line)
236 break;
237
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200238 /* Skip lines that don't start with GNUPG status */
239 if (!skip_prefix(line, "[GNUPG:] ", &line))
240 continue;
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700241
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200242 /* Iterate over all search strings */
243 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
244 if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000245 /*
246 * GOODSIG, BADSIG etc. can occur only once for
247 * each signature. Therefore, if we had more
248 * than one then we're dealing with multiple
249 * signatures. We don't support them
250 * currently, and they're rather hard to
251 * create, so something is likely fishy and we
252 * should reject them altogether.
253 */
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200254 if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
Junio C Hamano02561892018-11-03 00:53:57 +0900255 if (seen_exclusive_status++)
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000256 goto error;
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200257 }
258
Michał Górny3daaaab2018-10-22 18:38:20 +0200259 if (sigcheck_gpg_status[i].result)
260 sigc->result = sigcheck_gpg_status[i].result;
Michał Górny0b11a842018-10-22 18:38:19 +0200261 /* Do we have key information? */
262 if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200263 next = strchrnul(line, ' ');
Hans Jerry Illikainen392b8622019-11-21 23:43:35 +0000264 replace_cstring(&sigc->key, line, next);
Michał Górny0b11a842018-10-22 18:38:19 +0200265 /* Do we have signer information? */
266 if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200267 line = next + 1;
268 next = strchrnul(line, '\n');
Hans Jerry Illikainen392b8622019-11-21 23:43:35 +0000269 replace_cstring(&sigc->signer, line, next);
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200270 }
271 }
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000272
273 /* Do we have trust level? */
274 if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
275 /*
276 * GPG v1 and v2 differs in how the
277 * TRUST_ lines are written. Some
278 * trust lines contain no additional
279 * space-separated information for v1.
280 */
281 size_t trust_size = strcspn(line, " \n");
282 char *trust = xmemdupz(line, trust_size);
283
284 if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
285 free(trust);
286 goto error;
287 }
288 free(trust);
289 }
290
Michał Górny3daaaab2018-10-22 18:38:20 +0200291 /* Do we have fingerprint? */
292 if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
Hans Jerry Illikainen67a6ea62019-11-22 20:23:12 +0000293 const char *limit;
294 char **field;
295
Michał Górny3daaaab2018-10-22 18:38:20 +0200296 next = strchrnul(line, ' ');
Hans Jerry Illikainen392b8622019-11-21 23:43:35 +0000297 replace_cstring(&sigc->fingerprint, line, next);
Michał Górny4de93942018-10-22 18:38:21 +0200298
Hans Jerry Illikainen67a6ea62019-11-22 20:23:12 +0000299 /*
300 * Skip interim fields. The search is
301 * limited to the same line since only
302 * OpenPGP signatures has a field with
303 * the primary fingerprint.
304 */
305 limit = strchrnul(line, '\n');
Michał Górny4de93942018-10-22 18:38:21 +0200306 for (j = 9; j > 0; j--) {
Hans Jerry Illikainen67a6ea62019-11-22 20:23:12 +0000307 if (!*next || limit <= next)
Michał Górny4de93942018-10-22 18:38:21 +0200308 break;
309 line = next + 1;
310 next = strchrnul(line, ' ');
311 }
312
Hans Jerry Illikainen67a6ea62019-11-22 20:23:12 +0000313 field = &sigc->primary_key_fingerprint;
314 if (!j) {
315 next = strchrnul(line, '\n');
316 replace_cstring(field, line, next);
317 } else {
318 replace_cstring(field, NULL, NULL);
319 }
Michał Górny3daaaab2018-10-22 18:38:20 +0200320 }
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200321
322 break;
Michael J Gruber661a1802016-10-12 15:04:15 +0200323 }
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700324 }
325 }
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200326 return;
327
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000328error:
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200329 sigc->result = 'E';
330 /* Clear partial data to avoid confusion */
Michał Górny4de93942018-10-22 18:38:21 +0200331 FREE_AND_NULL(sigc->primary_key_fingerprint);
Michał Górny3daaaab2018-10-22 18:38:20 +0200332 FREE_AND_NULL(sigc->fingerprint);
Michał Górnyda6cf1b2018-10-20 21:30:20 +0200333 FREE_AND_NULL(sigc->signer);
334 FREE_AND_NULL(sigc->key);
Junio C Hamanoa50e7ca2014-08-14 15:31:13 -0700335}
336
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000337static int verify_gpg_signed_buffer(struct signature_check *sigc,
Fabian Stelzer02769432021-12-09 09:52:43 +0100338 struct gpg_format *fmt,
339 const char *signature,
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000340 size_t signature_size)
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000341{
342 struct child_process gpg = CHILD_PROCESS_INIT;
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000343 struct tempfile *temp;
344 int ret;
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000345 struct strbuf gpg_stdout = STRBUF_INIT;
346 struct strbuf gpg_stderr = STRBUF_INIT;
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000347
348 temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
349 if (!temp)
350 return error_errno(_("could not create temporary file"));
351 if (write_in_full(temp->fd, signature, signature_size) < 0 ||
352 close_tempfile_gently(temp) < 0) {
353 error_errno(_("failed writing detached signature to '%s'"),
354 temp->filename.buf);
355 delete_tempfile(&temp);
356 return -1;
357 }
358
Jeff Kingef8d7ac2020-07-28 16:24:53 -0400359 strvec_push(&gpg.args, fmt->program);
360 strvec_pushv(&gpg.args, fmt->verify_args);
361 strvec_pushl(&gpg.args,
Jeff Kingf6d89422020-07-28 16:26:31 -0400362 "--status-fd=1",
363 "--verify", temp->filename.buf, "-",
364 NULL);
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000365
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000366 sigchain_push(SIGPIPE, SIG_IGN);
Fabian Stelzer02769432021-12-09 09:52:43 +0100367 ret = pipe_command(&gpg, sigc->payload, sigc->payload_len, &gpg_stdout, 0,
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000368 &gpg_stderr, 0);
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000369 sigchain_pop(SIGPIPE);
370
371 delete_tempfile(&temp);
372
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000373 ret |= !strstr(gpg_stdout.buf, "\n[GNUPG:] GOODSIG ");
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000374 sigc->output = strbuf_detach(&gpg_stderr, NULL);
375 sigc->gpg_status = strbuf_detach(&gpg_stdout, NULL);
376
377 parse_gpg_output(sigc);
378
379 strbuf_release(&gpg_stdout);
380 strbuf_release(&gpg_stderr);
Hans Jerry Illikainen67948982020-03-04 11:48:04 +0000381
382 return ret;
383}
384
Fabian Stelzerfacca532021-09-10 20:07:39 +0000385static void parse_ssh_output(struct signature_check *sigc)
386{
387 const char *line, *principal, *search;
Jeff King78d468f2021-10-18 13:15:00 -0400388 char *to_free;
Fabian Stelzerfacca532021-09-10 20:07:39 +0000389 char *key = NULL;
390
391 /*
392 * ssh-keygen output should be:
393 * Good "git" signature for PRINCIPAL with RSA key SHA256:FINGERPRINT
394 *
395 * or for valid but unknown keys:
396 * Good "git" signature with RSA key SHA256:FINGERPRINT
397 *
398 * Note that "PRINCIPAL" can contain whitespace, "RSA" and
399 * "SHA256" part could be a different token that names of
400 * the algorithms used, and "FINGERPRINT" is a hexadecimal
401 * string. By finding the last occurence of " with ", we can
402 * reliably parse out the PRINCIPAL.
403 */
404 sigc->result = 'B';
405 sigc->trust_level = TRUST_NEVER;
406
Jeff King78d468f2021-10-18 13:15:00 -0400407 line = to_free = xmemdupz(sigc->output, strcspn(sigc->output, "\n"));
Fabian Stelzerfacca532021-09-10 20:07:39 +0000408
409 if (skip_prefix(line, "Good \"git\" signature for ", &line)) {
Fabian Stelzerfacca532021-09-10 20:07:39 +0000410 /* Search for the last "with" to get the full principal */
411 principal = line;
412 do {
413 search = strstr(line, " with ");
414 if (search)
415 line = search + 1;
416 } while (search != NULL);
René Scharfe18b18502021-10-30 19:04:56 +0200417 if (line == principal)
418 goto cleanup;
419
420 /* Valid signature and known principal */
421 sigc->result = 'G';
422 sigc->trust_level = TRUST_FULLY;
Fabian Stelzerfacca532021-09-10 20:07:39 +0000423 sigc->signer = xmemdupz(principal, line - principal - 1);
424 } else if (skip_prefix(line, "Good \"git\" signature with ", &line)) {
425 /* Valid signature, but key unknown */
426 sigc->result = 'G';
427 sigc->trust_level = TRUST_UNDEFINED;
428 } else {
Jeff King78d468f2021-10-18 13:15:00 -0400429 goto cleanup;
Fabian Stelzerfacca532021-09-10 20:07:39 +0000430 }
431
René Scharfe65db97b2021-10-30 19:07:38 +0200432 key = strstr(line, "key ");
Fabian Stelzerfacca532021-09-10 20:07:39 +0000433 if (key) {
René Scharfe65db97b2021-10-30 19:07:38 +0200434 sigc->fingerprint = xstrdup(strstr(line, "key ") + 4);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000435 sigc->key = xstrdup(sigc->fingerprint);
436 } else {
437 /*
438 * Output did not match what we expected
439 * Treat the signature as bad
440 */
441 sigc->result = 'B';
442 }
Jeff King78d468f2021-10-18 13:15:00 -0400443
444cleanup:
445 free(to_free);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000446}
447
448static int verify_ssh_signed_buffer(struct signature_check *sigc,
Fabian Stelzer02769432021-12-09 09:52:43 +0100449 struct gpg_format *fmt,
450 const char *signature,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000451 size_t signature_size)
452{
453 struct child_process ssh_keygen = CHILD_PROCESS_INIT;
454 struct tempfile *buffer_file;
455 int ret = -1;
456 const char *line;
Fabian Stelzerfacca532021-09-10 20:07:39 +0000457 char *principal;
458 struct strbuf ssh_principals_out = STRBUF_INIT;
459 struct strbuf ssh_principals_err = STRBUF_INIT;
460 struct strbuf ssh_keygen_out = STRBUF_INIT;
461 struct strbuf ssh_keygen_err = STRBUF_INIT;
Fabian Stelzer6393c952021-12-09 09:52:45 +0100462 struct strbuf verify_time = STRBUF_INIT;
463 const struct date_mode verify_date_mode = {
464 .type = DATE_STRFTIME,
465 .strftime_fmt = "%Y%m%d%H%M%S",
466 /* SSH signing key validity has no timezone information - Use the local timezone */
467 .local = 1,
468 };
Fabian Stelzerfacca532021-09-10 20:07:39 +0000469
470 if (!ssh_allowed_signers) {
471 error(_("gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification"));
472 return -1;
473 }
474
475 buffer_file = mks_tempfile_t(".git_vtag_tmpXXXXXX");
476 if (!buffer_file)
477 return error_errno(_("could not create temporary file"));
478 if (write_in_full(buffer_file->fd, signature, signature_size) < 0 ||
479 close_tempfile_gently(buffer_file) < 0) {
480 error_errno(_("failed writing detached signature to '%s'"),
481 buffer_file->filename.buf);
482 delete_tempfile(&buffer_file);
483 return -1;
484 }
485
Fabian Stelzer6393c952021-12-09 09:52:45 +0100486 if (sigc->payload_timestamp)
487 strbuf_addf(&verify_time, "-Overify-time=%s",
René Scharfe9720d232024-04-05 19:44:59 +0200488 show_date(sigc->payload_timestamp, 0, verify_date_mode));
Fabian Stelzer6393c952021-12-09 09:52:45 +0100489
Fabian Stelzerfacca532021-09-10 20:07:39 +0000490 /* Find the principal from the signers */
491 strvec_pushl(&ssh_keygen.args, fmt->program,
492 "-Y", "find-principals",
493 "-f", ssh_allowed_signers,
494 "-s", buffer_file->filename.buf,
Fabian Stelzer6393c952021-12-09 09:52:45 +0100495 verify_time.buf,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000496 NULL);
497 ret = pipe_command(&ssh_keygen, NULL, 0, &ssh_principals_out, 0,
498 &ssh_principals_err, 0);
499 if (ret && strstr(ssh_principals_err.buf, "usage:")) {
500 error(_("ssh-keygen -Y find-principals/verify is needed for ssh signature verification (available in openssh version 8.2p1+)"));
501 goto out;
502 }
503 if (ret || !ssh_principals_out.len) {
504 /*
505 * We did not find a matching principal in the allowedSigners
506 * Check without validation
507 */
508 child_process_init(&ssh_keygen);
509 strvec_pushl(&ssh_keygen.args, fmt->program,
510 "-Y", "check-novalidate",
511 "-n", "git",
512 "-s", buffer_file->filename.buf,
Fabian Stelzer6393c952021-12-09 09:52:45 +0100513 verify_time.buf,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000514 NULL);
Fabian Stelzer02769432021-12-09 09:52:43 +0100515 pipe_command(&ssh_keygen, sigc->payload, sigc->payload_len,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000516 &ssh_keygen_out, 0, &ssh_keygen_err, 0);
517
518 /*
519 * Fail on unknown keys
520 * we still call check-novalidate to display the signature info
521 */
522 ret = -1;
523 } else {
524 /* Check every principal we found (one per line) */
Fabian Stelzercaeef012022-01-07 10:07:35 +0100525 const char *next;
526 for (line = ssh_principals_out.buf;
527 *line;
528 line = next) {
529 const char *end_of_text;
Fabian Stelzerfacca532021-09-10 20:07:39 +0000530
Fabian Stelzercaeef012022-01-07 10:07:35 +0100531 next = end_of_text = strchrnul(line, '\n');
532
533 /* Did we find a LF, and did we have CR before it? */
534 if (*end_of_text &&
535 line < end_of_text &&
536 end_of_text[-1] == '\r')
537 end_of_text--;
538
539 /* Unless we hit NUL, skip over the LF we found */
540 if (*next)
541 next++;
542
543 /* Not all lines are data. Skip empty ones */
544 if (line == end_of_text)
545 continue;
546
547 /* We now know we have an non-empty line. Process it */
548 principal = xmemdupz(line, end_of_text - line);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000549
550 child_process_init(&ssh_keygen);
551 strbuf_release(&ssh_keygen_out);
552 strbuf_release(&ssh_keygen_err);
553 strvec_push(&ssh_keygen.args, fmt->program);
554 /*
555 * We found principals
556 * Try with each until we find a match
557 */
558 strvec_pushl(&ssh_keygen.args, "-Y", "verify",
559 "-n", "git",
560 "-f", ssh_allowed_signers,
561 "-I", principal,
562 "-s", buffer_file->filename.buf,
Fabian Stelzer6393c952021-12-09 09:52:45 +0100563 verify_time.buf,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000564 NULL);
565
566 if (ssh_revocation_file) {
567 if (file_exists(ssh_revocation_file)) {
568 strvec_pushl(&ssh_keygen.args, "-r",
569 ssh_revocation_file, NULL);
570 } else {
571 warning(_("ssh signing revocation file configured but not found: %s"),
572 ssh_revocation_file);
573 }
574 }
575
576 sigchain_push(SIGPIPE, SIG_IGN);
Fabian Stelzer02769432021-12-09 09:52:43 +0100577 ret = pipe_command(&ssh_keygen, sigc->payload, sigc->payload_len,
Fabian Stelzerfacca532021-09-10 20:07:39 +0000578 &ssh_keygen_out, 0, &ssh_keygen_err, 0);
579 sigchain_pop(SIGPIPE);
580
581 FREE_AND_NULL(principal);
582
583 if (!ret)
584 ret = !starts_with(ssh_keygen_out.buf, "Good");
585
586 if (!ret)
587 break;
588 }
589 }
590
Jeff King2982b652024-03-12 05:17:27 -0400591 strbuf_stripspace(&ssh_keygen_out, NULL);
592 strbuf_stripspace(&ssh_keygen_err, NULL);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000593 /* Add stderr outputs to show the user actual ssh-keygen errors */
594 strbuf_add(&ssh_keygen_out, ssh_principals_err.buf, ssh_principals_err.len);
595 strbuf_add(&ssh_keygen_out, ssh_keygen_err.buf, ssh_keygen_err.len);
596 sigc->output = strbuf_detach(&ssh_keygen_out, NULL);
597 sigc->gpg_status = xstrdup(sigc->output);
598
599 parse_ssh_output(sigc);
600
601out:
602 if (buffer_file)
603 delete_tempfile(&buffer_file);
604 strbuf_release(&ssh_principals_out);
605 strbuf_release(&ssh_principals_err);
606 strbuf_release(&ssh_keygen_out);
607 strbuf_release(&ssh_keygen_err);
Fabian Stelzer6393c952021-12-09 09:52:45 +0100608 strbuf_release(&verify_time);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000609
610 return ret;
611}
612
Fabian Stelzer6393c952021-12-09 09:52:45 +0100613static int parse_payload_metadata(struct signature_check *sigc)
614{
615 const char *ident_line = NULL;
616 size_t ident_len;
617 struct ident_split ident;
618 const char *signer_header;
619
620 switch (sigc->payload_type) {
621 case SIGNATURE_PAYLOAD_COMMIT:
622 signer_header = "committer";
623 break;
624 case SIGNATURE_PAYLOAD_TAG:
625 signer_header = "tagger";
626 break;
627 case SIGNATURE_PAYLOAD_UNDEFINED:
628 case SIGNATURE_PAYLOAD_PUSH_CERT:
629 /* Ignore payloads we don't want to parse */
630 return 0;
631 default:
632 BUG("invalid value for sigc->payload_type");
633 }
634
635 ident_line = find_commit_header(sigc->payload, signer_header, &ident_len);
636 if (!ident_line || !ident_len)
637 return 1;
638
639 if (split_ident_line(&ident, ident_line, ident_len))
640 return 1;
641
642 if (!sigc->payload_timestamp && ident.date_begin && ident.date_end)
643 sigc->payload_timestamp = parse_timestamp(ident.date_begin, NULL, 10);
644
645 return 0;
646}
647
Fabian Stelzer02769432021-12-09 09:52:43 +0100648int check_signature(struct signature_check *sigc,
649 const char *signature, size_t slen)
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000650{
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000651 struct gpg_format *fmt;
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000652 int status;
653
Junio C Hamanofd2d4c12023-02-09 12:24:14 -0800654 gpg_interface_lazy_init();
655
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000656 sigc->result = 'N';
Jeff King7891e462023-04-18 21:29:57 -0400657 sigc->trust_level = TRUST_UNDEFINED;
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000658
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000659 fmt = get_format_by_sig(signature);
660 if (!fmt)
661 die(_("bad/incompatible signature '%s'"), signature);
662
Fabian Stelzer6393c952021-12-09 09:52:45 +0100663 if (parse_payload_metadata(sigc))
664 return 1;
665
Fabian Stelzer02769432021-12-09 09:52:43 +0100666 status = fmt->verify_signed_buffer(sigc, fmt, signature, slen);
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000667
668 if (status && !sigc->output)
669 return !!status;
670
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000671 status |= sigc->result != 'G';
672 status |= sigc->trust_level < configured_min_trust_level;
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000673
Junio C Hamano4e5dc9c2018-08-09 11:40:27 -0700674 return !!status;
brian m. carlsona4cc18f2015-06-21 23:14:38 +0000675}
676
brian m. carlsonca194d52015-06-21 23:14:41 +0000677void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
678{
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000679 const char *output = flags & GPG_VERIFY_RAW ? sigc->gpg_status :
680 sigc->output;
brian m. carlsonaeff29d2015-06-21 23:14:42 +0000681
brian m. carlsonca194d52015-06-21 23:14:41 +0000682 if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
Fabian Stelzer02769432021-12-09 09:52:43 +0100683 fwrite(sigc->payload, 1, sigc->payload_len, stdout);
brian m. carlsonca194d52015-06-21 23:14:41 +0000684
brian m. carlsonaeff29d2015-06-21 23:14:42 +0000685 if (output)
686 fputs(output, stderr);
brian m. carlsonca194d52015-06-21 23:14:41 +0000687}
688
brian m. carlson482c1192021-02-11 02:08:03 +0000689size_t parse_signed_buffer(const char *buf, size_t size)
Junio C Hamanod7c67662014-08-19 13:18:07 -0700690{
Junio C Hamanod7c67662014-08-19 13:18:07 -0700691 size_t len = 0;
Jeff King8b44b2b2018-04-13 15:18:35 -0600692 size_t match = size;
693 while (len < size) {
694 const char *eol;
695
Henning Schild58af57e2018-07-17 14:50:09 +0200696 if (get_format_by_sig(buf + len))
Jeff King8b44b2b2018-04-13 15:18:35 -0600697 match = len;
698
699 eol = memchr(buf + len, '\n', size - len);
Junio C Hamanod7c67662014-08-19 13:18:07 -0700700 len += eol ? eol - (buf + len) + 1 : size - len;
701 }
Jeff King8b44b2b2018-04-13 15:18:35 -0600702 return match;
Junio C Hamanod7c67662014-08-19 13:18:07 -0700703}
704
brian m. carlson482c1192021-02-11 02:08:03 +0000705int parse_signature(const char *buf, size_t size, struct strbuf *payload, struct strbuf *signature)
706{
707 size_t match = parse_signed_buffer(buf, size);
708 if (match != size) {
709 strbuf_add(payload, buf, match);
brian m. carlson9b27b492021-02-11 02:08:06 +0000710 remove_signature(payload);
brian m. carlson482c1192021-02-11 02:08:03 +0000711 strbuf_add(signature, buf + match, size - match);
712 return 1;
713 }
714 return 0;
715}
716
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700717void set_signing_key(const char *key)
718{
Junio C Hamanofd2d4c12023-02-09 12:24:14 -0800719 gpg_interface_lazy_init();
720
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700721 free(configured_signing_key);
722 configured_signing_key = xstrdup(key);
723}
724
Glen Chooa4e7e312023-06-28 19:26:22 +0000725static int git_gpg_config(const char *var, const char *value,
726 const struct config_context *ctx UNUSED,
727 void *cb UNUSED)
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700728{
Henning Schild58af57e2018-07-17 14:50:09 +0200729 struct gpg_format *fmt = NULL;
Patrick Steinhardtb5670042024-06-07 08:37:39 +0200730 const char *fmtname = NULL;
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000731 char *trust;
732 int ret;
Henning Schild58af57e2018-07-17 14:50:09 +0200733
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700734 if (!strcmp(var, "user.signingkey")) {
Jeff King1b0eeec2018-04-13 15:18:30 -0600735 if (!value)
736 return config_error_nonbool(var);
Junio C Hamano0c5e70f2011-11-29 12:29:48 -0800737 set_signing_key(value);
Jeff King1b0eeec2018-04-13 15:18:30 -0600738 return 0;
Junio C Hamano0c5e70f2011-11-29 12:29:48 -0800739 }
Jeff King1b0eeec2018-04-13 15:18:30 -0600740
Henning Schild57a8dd72018-07-17 14:50:07 +0200741 if (!strcmp(var, "gpg.format")) {
742 if (!value)
743 return config_error_nonbool(var);
Henning Schild58af57e2018-07-17 14:50:09 +0200744 fmt = get_format_by_name(value);
745 if (!fmt)
Jean-Noël Avila1a8aea82022-01-31 22:07:47 +0000746 return error(_("invalid value for '%s': '%s'"),
Henning Schild57a8dd72018-07-17 14:50:07 +0200747 var, value);
Henning Schild58af57e2018-07-17 14:50:09 +0200748 use_format = fmt;
749 return 0;
Henning Schild57a8dd72018-07-17 14:50:07 +0200750 }
751
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000752 if (!strcmp(var, "gpg.mintrustlevel")) {
753 if (!value)
754 return config_error_nonbool(var);
755
756 trust = xstrdup_toupper(value);
757 ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
758 free(trust);
759
760 if (ret)
Jean-Noël Avila1a8aea82022-01-31 22:07:47 +0000761 return error(_("invalid value for '%s': '%s'"),
762 var, value);
Hans Jerry Illikainen54887b42019-12-27 13:55:57 +0000763 return 0;
764 }
765
Jeff King004c9432023-12-07 02:26:31 -0500766 if (!strcmp(var, "gpg.ssh.defaultkeycommand"))
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000767 return git_config_string(&ssh_default_key_command, var, value);
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000768
Jeff King004c9432023-12-07 02:26:31 -0500769 if (!strcmp(var, "gpg.ssh.allowedsignersfile"))
Fabian Stelzerfacca532021-09-10 20:07:39 +0000770 return git_config_pathname(&ssh_allowed_signers, var, value);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000771
Jeff King004c9432023-12-07 02:26:31 -0500772 if (!strcmp(var, "gpg.ssh.revocationfile"))
Fabian Stelzerfacca532021-09-10 20:07:39 +0000773 return git_config_pathname(&ssh_revocation_file, var, value);
Fabian Stelzerfacca532021-09-10 20:07:39 +0000774
Henning Schildb02f51b2018-07-17 14:50:11 +0200775 if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
Henning Schild58af57e2018-07-17 14:50:09 +0200776 fmtname = "openpgp";
777
Henning Schild1e7adb92018-07-17 14:50:12 +0200778 if (!strcmp(var, "gpg.x509.program"))
779 fmtname = "x509";
780
Fabian Stelzer29b31572021-09-10 20:07:36 +0000781 if (!strcmp(var, "gpg.ssh.program"))
782 fmtname = "ssh";
783
Henning Schild58af57e2018-07-17 14:50:09 +0200784 if (fmtname) {
785 fmt = get_format_by_name(fmtname);
Patrick Steinhardtc113c5d2024-06-07 08:37:43 +0200786 return git_config_string((char **) &fmt->program, var, value);
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700787 }
Jeff King1b0eeec2018-04-13 15:18:30 -0600788
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700789 return 0;
790}
791
Fabian Stelzer350a2512021-11-19 16:07:06 +0100792/*
793 * Returns 1 if `string` contains a literal ssh key, 0 otherwise
794 * `key` will be set to the start of the actual key if a prefix is present.
795 */
796static int is_literal_ssh_key(const char *string, const char **key)
797{
798 if (skip_prefix(string, "key::", key))
799 return 1;
800 if (starts_with(string, "ssh-")) {
801 *key = string;
802 return 1;
803 }
804 return 0;
805}
806
Fabian Stelzer4838f622021-09-10 20:07:38 +0000807static char *get_ssh_key_fingerprint(const char *signing_key)
808{
809 struct child_process ssh_keygen = CHILD_PROCESS_INIT;
810 int ret = -1;
811 struct strbuf fingerprint_stdout = STRBUF_INIT;
812 struct strbuf **fingerprint;
Jeff Kingf3af71c2021-10-18 13:15:37 -0400813 char *fingerprint_ret;
Fabian Stelzer350a2512021-11-19 16:07:06 +0100814 const char *literal_key = NULL;
Fabian Stelzer4838f622021-09-10 20:07:38 +0000815
816 /*
817 * With SSH Signing this can contain a filename or a public key
818 * For textual representation we usually want a fingerprint
819 */
Fabian Stelzer350a2512021-11-19 16:07:06 +0100820 if (is_literal_ssh_key(signing_key, &literal_key)) {
Fabian Stelzer4838f622021-09-10 20:07:38 +0000821 strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf", "-", NULL);
Fabian Stelzer350a2512021-11-19 16:07:06 +0100822 ret = pipe_command(&ssh_keygen, literal_key,
823 strlen(literal_key), &fingerprint_stdout, 0,
Fabian Stelzer4838f622021-09-10 20:07:38 +0000824 NULL, 0);
825 } else {
826 strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf",
827 configured_signing_key, NULL);
828 ret = pipe_command(&ssh_keygen, NULL, 0, &fingerprint_stdout, 0,
829 NULL, 0);
830 }
831
832 if (!!ret)
833 die_errno(_("failed to get the ssh fingerprint for key '%s'"),
834 signing_key);
835
836 fingerprint = strbuf_split_max(&fingerprint_stdout, ' ', 3);
837 if (!fingerprint[1])
838 die_errno(_("failed to get the ssh fingerprint for key '%s'"),
839 signing_key);
840
Jeff Kingf3af71c2021-10-18 13:15:37 -0400841 fingerprint_ret = strbuf_detach(fingerprint[1], NULL);
842 strbuf_list_free(fingerprint);
843 strbuf_release(&fingerprint_stdout);
844 return fingerprint_ret;
Fabian Stelzer4838f622021-09-10 20:07:38 +0000845}
846
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000847/* Returns the first public key from an ssh-agent to use for signing */
848static const char *get_default_ssh_signing_key(void)
849{
850 struct child_process ssh_default_key = CHILD_PROCESS_INIT;
851 int ret = -1;
852 struct strbuf key_stdout = STRBUF_INIT, key_stderr = STRBUF_INIT;
853 struct strbuf **keys;
854 char *key_command = NULL;
855 const char **argv;
856 int n;
857 char *default_key = NULL;
Fabian Stelzer350a2512021-11-19 16:07:06 +0100858 const char *literal_key = NULL;
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000859
860 if (!ssh_default_key_command)
861 die(_("either user.signingkey or gpg.ssh.defaultKeyCommand needs to be configured"));
862
863 key_command = xstrdup(ssh_default_key_command);
864 n = split_cmdline(key_command, &argv);
865
866 if (n < 0)
867 die("malformed build-time gpg.ssh.defaultKeyCommand: %s",
868 split_cmdline_strerror(n));
869
870 strvec_pushv(&ssh_default_key.args, argv);
871 ret = pipe_command(&ssh_default_key, NULL, 0, &key_stdout, 0,
872 &key_stderr, 0);
873
874 if (!ret) {
875 keys = strbuf_split_max(&key_stdout, '\n', 2);
Fabian Stelzer350a2512021-11-19 16:07:06 +0100876 if (keys[0] && is_literal_ssh_key(keys[0]->buf, &literal_key)) {
877 /*
878 * We only use `is_literal_ssh_key` here to check validity
879 * The prefix will be stripped when the key is used.
880 */
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000881 default_key = strbuf_detach(keys[0], NULL);
882 } else {
Jiang Xinf7337192021-11-01 10:14:17 +0800883 warning(_("gpg.ssh.defaultKeyCommand succeeded but returned no keys: %s %s"),
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000884 key_stderr.buf, key_stdout.buf);
885 }
886
887 strbuf_list_free(keys);
888 } else {
889 warning(_("gpg.ssh.defaultKeyCommand failed: %s %s"),
890 key_stderr.buf, key_stdout.buf);
891 }
892
893 free(key_command);
894 free(argv);
895 strbuf_release(&key_stdout);
896
897 return default_key;
898}
899
Fabian Stelzer4838f622021-09-10 20:07:38 +0000900static const char *get_ssh_key_id(void) {
901 return get_ssh_key_fingerprint(get_signing_key());
902}
903
904/* Returns a textual but unique representation of the signing key */
905const char *get_signing_key_id(void)
906{
Junio C Hamanofd2d4c12023-02-09 12:24:14 -0800907 gpg_interface_lazy_init();
908
Fabian Stelzer4838f622021-09-10 20:07:38 +0000909 if (use_format->get_key_id) {
910 return use_format->get_key_id();
911 }
912
913 /* GPG/GPGSM only store a key id on this variable */
914 return get_signing_key();
915}
916
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700917const char *get_signing_key(void)
918{
Junio C Hamanofd2d4c12023-02-09 12:24:14 -0800919 gpg_interface_lazy_init();
920
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700921 if (configured_signing_key)
922 return configured_signing_key;
Fabian Stelzerfd9e2262021-09-10 20:07:37 +0000923 if (use_format->get_default_key) {
924 return use_format->get_default_key();
925 }
926
927 return git_committer_info(IDENT_STRICT | IDENT_NO_DATE);
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700928}
929
Jaydeep Das803978d2022-07-11 05:00:50 +0000930const char *gpg_trust_level_to_str(enum signature_trust_level level)
931{
932 struct sigcheck_gpg_trust_level *trust;
933
934 if (level < 0 || level >= ARRAY_SIZE(sigcheck_gpg_trust_level))
935 BUG("invalid trust level requested %d", level);
936
937 trust = &sigcheck_gpg_trust_level[level];
938 if (trust->value != level)
939 BUG("sigcheck_gpg_trust_level[] unsorted");
940
941 return sigcheck_gpg_trust_level[level].display_key;
942}
943
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700944int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
945{
Junio C Hamanofd2d4c12023-02-09 12:24:14 -0800946 gpg_interface_lazy_init();
947
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000948 return use_format->sign_buffer(buffer, signature, signing_key);
949}
950
Fabian Stelzer29b31572021-09-10 20:07:36 +0000951/*
952 * Strip CR from the line endings, in case we are on Windows.
953 * NEEDSWORK: make it trim only CRs before LFs and rename
954 */
955static void remove_cr_after(struct strbuf *buffer, size_t offset)
956{
957 size_t i, j;
958
959 for (i = j = offset; i < buffer->len; i++) {
960 if (buffer->buf[i] != '\r') {
961 if (i != j)
962 buffer->buf[j] = buffer->buf[i];
963 j++;
964 }
965 }
966 strbuf_setlen(buffer, j);
967}
968
Fabian Stelzerb5726a52021-09-10 20:07:34 +0000969static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
970 const char *signing_key)
971{
René Scharfed3180272014-08-19 21:09:35 +0200972 struct child_process gpg = CHILD_PROCESS_INIT;
Jeff King0581b542016-06-17 19:38:55 -0400973 int ret;
Fabian Stelzer29b31572021-09-10 20:07:36 +0000974 size_t bottom;
Fabian Stelzera075e792022-03-04 11:25:17 +0100975 const char *cp;
Michael J Gruberefee9552016-06-17 19:38:59 -0400976 struct strbuf gpg_status = STRBUF_INIT;
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700977
Jeff Kingef8d7ac2020-07-28 16:24:53 -0400978 strvec_pushl(&gpg.args,
Jeff Kingf6d89422020-07-28 16:26:31 -0400979 use_format->program,
980 "--status-fd=2",
981 "-bsau", signing_key,
982 NULL);
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700983
Jeff King0581b542016-06-17 19:38:55 -0400984 bottom = signature->len;
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700985
986 /*
987 * When the username signingkey is bad, program could be terminated
988 * because gpg exits without reading and then write gets SIGPIPE.
989 */
990 sigchain_push(SIGPIPE, SIG_IGN);
Jeff King0581b542016-06-17 19:38:55 -0400991 ret = pipe_command(&gpg, buffer->buf, buffer->len,
Michael J Gruberefee9552016-06-17 19:38:59 -0400992 signature, 1024, &gpg_status, 0);
Junio C Hamano2f47eae2011-09-07 21:19:47 -0700993 sigchain_pop(SIGPIPE);
994
Fabian Stelzera075e792022-03-04 11:25:17 +0100995 for (cp = gpg_status.buf;
996 cp && (cp = strstr(cp, "[GNUPG:] SIG_CREATED "));
997 cp++) {
998 if (cp == gpg_status.buf || cp[-1] == '\n')
999 break; /* found */
1000 }
1001 ret |= !cp;
Johannes Schindelinad6b3202023-02-15 05:58:34 +00001002 if (ret) {
1003 error(_("gpg failed to sign the data:\n%s"),
1004 gpg_status.len ? gpg_status.buf : "(no gpg output)");
1005 strbuf_release(&gpg_status);
1006 return -1;
1007 }
Michael J Gruberefee9552016-06-17 19:38:59 -04001008 strbuf_release(&gpg_status);
Junio C Hamano2f47eae2011-09-07 21:19:47 -07001009
1010 /* Strip CR from the line endings, in case we are on Windows. */
Fabian Stelzer29b31572021-09-10 20:07:36 +00001011 remove_cr_after(signature, bottom);
Junio C Hamano2f47eae2011-09-07 21:19:47 -07001012
1013 return 0;
1014}
Fabian Stelzer29b31572021-09-10 20:07:36 +00001015
1016static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
1017 const char *signing_key)
1018{
1019 struct child_process signer = CHILD_PROCESS_INIT;
1020 int ret = -1;
1021 size_t bottom, keylen;
1022 struct strbuf signer_stderr = STRBUF_INIT;
1023 struct tempfile *key_file = NULL, *buffer_file = NULL;
1024 char *ssh_signing_key_file = NULL;
1025 struct strbuf ssh_signature_filename = STRBUF_INIT;
Fabian Stelzer350a2512021-11-19 16:07:06 +01001026 const char *literal_key = NULL;
Adam Szkodadce7b312023-01-25 12:40:50 +00001027 int literal_ssh_key = 0;
Fabian Stelzer29b31572021-09-10 20:07:36 +00001028
1029 if (!signing_key || signing_key[0] == '\0')
1030 return error(
Jiang Xinb4eda052022-06-17 18:03:09 +08001031 _("user.signingKey needs to be set for ssh signing"));
Fabian Stelzer29b31572021-09-10 20:07:36 +00001032
Fabian Stelzer350a2512021-11-19 16:07:06 +01001033 if (is_literal_ssh_key(signing_key, &literal_key)) {
Fabian Stelzer29b31572021-09-10 20:07:36 +00001034 /* A literal ssh key */
Adam Szkodadce7b312023-01-25 12:40:50 +00001035 literal_ssh_key = 1;
Fabian Stelzer29b31572021-09-10 20:07:36 +00001036 key_file = mks_tempfile_t(".git_signing_key_tmpXXXXXX");
1037 if (!key_file)
1038 return error_errno(
1039 _("could not create temporary file"));
Fabian Stelzer350a2512021-11-19 16:07:06 +01001040 keylen = strlen(literal_key);
1041 if (write_in_full(key_file->fd, literal_key, keylen) < 0 ||
Fabian Stelzer29b31572021-09-10 20:07:36 +00001042 close_tempfile_gently(key_file) < 0) {
1043 error_errno(_("failed writing ssh signing key to '%s'"),
1044 key_file->filename.buf);
1045 goto out;
1046 }
1047 ssh_signing_key_file = strbuf_detach(&key_file->filename, NULL);
1048 } else {
1049 /* We assume a file */
Elijah Newrenf7e552d2023-03-21 06:25:59 +00001050 ssh_signing_key_file = interpolate_path(signing_key, 1);
Fabian Stelzer29b31572021-09-10 20:07:36 +00001051 }
1052
1053 buffer_file = mks_tempfile_t(".git_signing_buffer_tmpXXXXXX");
1054 if (!buffer_file) {
1055 error_errno(_("could not create temporary file"));
1056 goto out;
1057 }
1058
1059 if (write_in_full(buffer_file->fd, buffer->buf, buffer->len) < 0 ||
1060 close_tempfile_gently(buffer_file) < 0) {
1061 error_errno(_("failed writing ssh signing key buffer to '%s'"),
1062 buffer_file->filename.buf);
1063 goto out;
1064 }
1065
1066 strvec_pushl(&signer.args, use_format->program,
1067 "-Y", "sign",
1068 "-n", "git",
1069 "-f", ssh_signing_key_file,
Fabian Stelzer29b31572021-09-10 20:07:36 +00001070 NULL);
Adam Szkodadce7b312023-01-25 12:40:50 +00001071 if (literal_ssh_key)
1072 strvec_push(&signer.args, "-U");
1073 strvec_push(&signer.args, buffer_file->filename.buf);
Fabian Stelzer29b31572021-09-10 20:07:36 +00001074
1075 sigchain_push(SIGPIPE, SIG_IGN);
1076 ret = pipe_command(&signer, NULL, 0, NULL, 0, &signer_stderr, 0);
1077 sigchain_pop(SIGPIPE);
1078
1079 if (ret) {
1080 if (strstr(signer_stderr.buf, "usage:"))
1081 error(_("ssh-keygen -Y sign is needed for ssh signing (available in openssh version 8.2p1+)"));
1082
Junio C Hamano69310492024-02-07 21:29:00 -08001083 ret = error("%s", signer_stderr.buf);
Fabian Stelzer29b31572021-09-10 20:07:36 +00001084 goto out;
1085 }
1086
1087 bottom = signature->len;
1088
1089 strbuf_addbuf(&ssh_signature_filename, &buffer_file->filename);
1090 strbuf_addstr(&ssh_signature_filename, ".sig");
1091 if (strbuf_read_file(signature, ssh_signature_filename.buf, 0) < 0) {
Phillip Wood36fb0d02022-10-04 10:01:34 +00001092 ret = error_errno(
Fabian Stelzer29b31572021-09-10 20:07:36 +00001093 _("failed reading ssh signing data buffer from '%s'"),
1094 ssh_signature_filename.buf);
Phillip Wood36fb0d02022-10-04 10:01:34 +00001095 goto out;
Fabian Stelzer29b31572021-09-10 20:07:36 +00001096 }
Fabian Stelzer29b31572021-09-10 20:07:36 +00001097 /* Strip CR from the line endings, in case we are on Windows. */
1098 remove_cr_after(signature, bottom);
1099
1100out:
1101 if (key_file)
1102 delete_tempfile(&key_file);
1103 if (buffer_file)
1104 delete_tempfile(&buffer_file);
Phillip Wood36fb0d02022-10-04 10:01:34 +00001105 if (ssh_signature_filename.len)
1106 unlink_or_warn(ssh_signature_filename.buf);
Fabian Stelzer29b31572021-09-10 20:07:36 +00001107 strbuf_release(&signer_stderr);
1108 strbuf_release(&ssh_signature_filename);
1109 FREE_AND_NULL(ssh_signing_key_file);
1110 return ret;
1111}