freshlybakedca.ke
Git fork
1#define USE_THE_REPOSITORY_VARIABLE
2
3#include "git-compat-util.h"
4#include "commit.h"
5#include "config.h"
6#include "date.h"
7#include "gettext.h"
8#include "run-command.h"
9#include "strbuf.h"
10#include "dir.h"
11#include "ident.h"
12#include "gpg-interface.h"
13#include "path.h"
14#include "sigchain.h"
15#include "tempfile.h"
16#include "alias.h"
17
18static int git_gpg_config(const char *, const char *,
19 const struct config_context *, void *);
20
21static void gpg_interface_lazy_init(void)
22{
23 static int done;
24
25 if (done)
26 return;
27 done = 1;
28 repo_config(the_repository, git_gpg_config, NULL);
29}
30
31static char *configured_signing_key;
32static char *ssh_default_key_command;
33static char *ssh_allowed_signers;
34static char *ssh_revocation_file;
35static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;
36
37struct gpg_format {
38 const char *name;
39 const char *program;
40 const char **verify_args;
41 const char **sigs;
42 int (*verify_signed_buffer)(struct signature_check *sigc,
43 struct gpg_format *fmt,
44 const char *signature,
45 size_t signature_size);
46 int (*sign_buffer)(struct strbuf *buffer, struct strbuf *signature,
47 const char *signing_key);
48 char *(*get_default_key)(void);
49 char *(*get_key_id)(void);
50};
51
52static const char *openpgp_verify_args[] = {
53 "--keyid-format=long",
54 NULL
55};
56static const char *openpgp_sigs[] = {
57 "-----BEGIN PGP SIGNATURE-----",
58 "-----BEGIN PGP MESSAGE-----",
59 NULL
60};
61
62static const char *x509_verify_args[] = {
63 NULL
64};
65static const char *x509_sigs[] = {
66 "-----BEGIN SIGNED MESSAGE-----",
67 NULL
68};
69
70static const char *ssh_verify_args[] = { NULL };
71static const char *ssh_sigs[] = {
72 "-----BEGIN SSH SIGNATURE-----",
73 NULL
74};
75
76static int verify_gpg_signed_buffer(struct signature_check *sigc,
77 struct gpg_format *fmt,
78 const char *signature,
79 size_t signature_size);
80static int verify_ssh_signed_buffer(struct signature_check *sigc,
81 struct gpg_format *fmt,
82 const char *signature,
83 size_t signature_size);
84static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
85 const char *signing_key);
86static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
87 const char *signing_key);
88
89static char *get_default_ssh_signing_key(void);
90
91static char *get_ssh_key_id(void);
92
93static struct gpg_format gpg_format[] = {
94 {
95 .name = "openpgp",
96 .program = "gpg",
97 .verify_args = openpgp_verify_args,
98 .sigs = openpgp_sigs,
99 .verify_signed_buffer = verify_gpg_signed_buffer,
100 .sign_buffer = sign_buffer_gpg,
101 .get_default_key = NULL,
102 .get_key_id = NULL,
103 },
104 {
105 .name = "x509",
106 .program = "gpgsm",
107 .verify_args = x509_verify_args,
108 .sigs = x509_sigs,
109 .verify_signed_buffer = verify_gpg_signed_buffer,
110 .sign_buffer = sign_buffer_gpg,
111 .get_default_key = NULL,
112 .get_key_id = NULL,
113 },
114 {
115 .name = "ssh",
116 .program = "ssh-keygen",
117 .verify_args = ssh_verify_args,
118 .sigs = ssh_sigs,
119 .verify_signed_buffer = verify_ssh_signed_buffer,
120 .sign_buffer = sign_buffer_ssh,
121 .get_default_key = get_default_ssh_signing_key,
122 .get_key_id = get_ssh_key_id,
123 },
124};
125
126static struct gpg_format *use_format = &gpg_format[0];
127
128static struct gpg_format *get_format_by_name(const char *str)
129{
130 for (size_t i = 0; i < ARRAY_SIZE(gpg_format); i++)
131 if (!strcmp(gpg_format[i].name, str))
132 return gpg_format + i;
133 return NULL;
134}
135
136static struct gpg_format *get_format_by_sig(const char *sig)
137{
138 int j;
139
140 for (size_t i = 0; i < ARRAY_SIZE(gpg_format); i++)
141 for (j = 0; gpg_format[i].sigs[j]; j++)
142 if (starts_with(sig, gpg_format[i].sigs[j]))
143 return gpg_format + i;
144 return NULL;
145}
146
147const char *get_signature_format(const char *buf)
148{
149 struct gpg_format *format = get_format_by_sig(buf);
150 return format ? format->name : "unknown";
151}
152
153int valid_signature_format(const char *format)
154{
155 return (!!get_format_by_name(format) ||
156 !strcmp(format, "unknown"));
157}
158
159void signature_check_clear(struct signature_check *sigc)
160{
161 FREE_AND_NULL(sigc->payload);
162 FREE_AND_NULL(sigc->output);
163 FREE_AND_NULL(sigc->gpg_status);
164 FREE_AND_NULL(sigc->signer);
165 FREE_AND_NULL(sigc->key);
166 FREE_AND_NULL(sigc->fingerprint);
167 FREE_AND_NULL(sigc->primary_key_fingerprint);
168}
169
170/* An exclusive status -- only one of them can appear in output */
171#define GPG_STATUS_EXCLUSIVE (1<<0)
172/* The status includes key identifier */
173#define GPG_STATUS_KEYID (1<<1)
174/* The status includes user identifier */
175#define GPG_STATUS_UID (1<<2)
176/* The status includes key fingerprints */
177#define GPG_STATUS_FINGERPRINT (1<<3)
178/* The status includes trust level */
179#define GPG_STATUS_TRUST_LEVEL (1<<4)
180
181/* Short-hand for standard exclusive *SIG status with keyid & UID */
182#define GPG_STATUS_STDSIG (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)
183
184static struct {
185 char result;
186 const char *check;
187 unsigned int flags;
188} sigcheck_gpg_status[] = {
189 { 'G', "GOODSIG ", GPG_STATUS_STDSIG },
190 { 'B', "BADSIG ", GPG_STATUS_STDSIG },
191 { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID },
192 { 'X', "EXPSIG ", GPG_STATUS_STDSIG },
193 { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
194 { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
195 { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
196 { 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
197};
198
199/* Keep the order same as enum signature_trust_level */
200static struct sigcheck_gpg_trust_level {
201 const char *key;
202 const char *display_key;
203 enum signature_trust_level value;
204} sigcheck_gpg_trust_level[] = {
205 { "UNDEFINED", "undefined", TRUST_UNDEFINED },
206 { "NEVER", "never", TRUST_NEVER },
207 { "MARGINAL", "marginal", TRUST_MARGINAL },
208 { "FULLY", "fully", TRUST_FULLY },
209 { "ULTIMATE", "ultimate", TRUST_ULTIMATE },
210};
211
212static void replace_cstring(char **field, const char *line, const char *next)
213{
214 free(*field);
215
216 if (line && next)
217 *field = xmemdupz(line, next - line);
218 else
219 *field = NULL;
220}
221
222static int parse_gpg_trust_level(const char *level,
223 enum signature_trust_level *res)
224{
225 size_t i;
226
227 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
228 if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
229 *res = sigcheck_gpg_trust_level[i].value;
230 return 0;
231 }
232 }
233 return 1;
234}
235
236static void parse_gpg_output(struct signature_check *sigc)
237{
238 const char *buf = sigc->gpg_status;
239 const char *line, *next;
240 int j;
241 int seen_exclusive_status = 0;
242
243 /* Iterate over all lines */
244 for (line = buf; *line; line = strchrnul(line+1, '\n')) {
245 while (*line == '\n')
246 line++;
247 if (!*line)
248 break;
249
250 /* Skip lines that don't start with GNUPG status */
251 if (!skip_prefix(line, "[GNUPG:] ", &line))
252 continue;
253
254 /* Iterate over all search strings */
255 for (size_t i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
256 if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
257 /*
258 * GOODSIG, BADSIG etc. can occur only once for
259 * each signature. Therefore, if we had more
260 * than one then we're dealing with multiple
261 * signatures. We don't support them
262 * currently, and they're rather hard to
263 * create, so something is likely fishy and we
264 * should reject them altogether.
265 */
266 if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
267 if (seen_exclusive_status++)
268 goto error;
269 }
270
271 if (sigcheck_gpg_status[i].result)
272 sigc->result = sigcheck_gpg_status[i].result;
273 /* Do we have key information? */
274 if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
275 next = strchrnul(line, ' ');
276 replace_cstring(&sigc->key, line, next);
277 /* Do we have signer information? */
278 if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
279 line = next + 1;
280 next = strchrnul(line, '\n');
281 replace_cstring(&sigc->signer, line, next);
282 }
283 }
284
285 /* Do we have trust level? */
286 if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
287 /*
288 * GPG v1 and v2 differs in how the
289 * TRUST_ lines are written. Some
290 * trust lines contain no additional
291 * space-separated information for v1.
292 */
293 size_t trust_size = strcspn(line, " \n");
294 char *trust = xmemdupz(line, trust_size);
295
296 if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
297 free(trust);
298 goto error;
299 }
300 free(trust);
301 }
302
303 /* Do we have fingerprint? */
304 if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
305 const char *limit;
306 char **field;
307
308 next = strchrnul(line, ' ');
309 replace_cstring(&sigc->fingerprint, line, next);
310
311 /*
312 * Skip interim fields. The search is
313 * limited to the same line since only
314 * OpenPGP signatures has a field with
315 * the primary fingerprint.
316 */
317 limit = strchrnul(line, '\n');
318 for (j = 9; j > 0; j--) {
319 if (!*next || limit <= next)
320 break;
321 line = next + 1;
322 next = strchrnul(line, ' ');
323 }
324
325 field = &sigc->primary_key_fingerprint;
326 if (!j) {
327 next = strchrnul(line, '\n');
328 replace_cstring(field, line, next);
329 } else {
330 replace_cstring(field, NULL, NULL);
331 }
332 }
333
334 break;
335 }
336 }
337 }
338 return;
339
340error:
341 sigc->result = 'E';
342 /* Clear partial data to avoid confusion */
343 FREE_AND_NULL(sigc->primary_key_fingerprint);
344 FREE_AND_NULL(sigc->fingerprint);
345 FREE_AND_NULL(sigc->signer);
346 FREE_AND_NULL(sigc->key);
347}
348
349static int verify_gpg_signed_buffer(struct signature_check *sigc,
350 struct gpg_format *fmt,
351 const char *signature,
352 size_t signature_size)
353{
354 struct child_process gpg = CHILD_PROCESS_INIT;
355 struct tempfile *temp;
356 int ret;
357 struct strbuf gpg_stdout = STRBUF_INIT;
358 struct strbuf gpg_stderr = STRBUF_INIT;
359
360 temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
361 if (!temp)
362 return error_errno(_("could not create temporary file"));
363 if (write_in_full(temp->fd, signature, signature_size) < 0 ||
364 close_tempfile_gently(temp) < 0) {
365 error_errno(_("failed writing detached signature to '%s'"),
366 temp->filename.buf);
367 delete_tempfile(&temp);
368 return -1;
369 }
370
371 strvec_push(&gpg.args, fmt->program);
372 strvec_pushv(&gpg.args, fmt->verify_args);
373 strvec_pushl(&gpg.args,
374 "--status-fd=1",
375 "--verify", temp->filename.buf, "-",
376 NULL);
377
378 sigchain_push(SIGPIPE, SIG_IGN);
379 ret = pipe_command(&gpg, sigc->payload, sigc->payload_len, &gpg_stdout, 0,
380 &gpg_stderr, 0);
381 sigchain_pop(SIGPIPE);
382
383 delete_tempfile(&temp);
384
385 ret |= !strstr(gpg_stdout.buf, "\n[GNUPG:] GOODSIG ");
386 sigc->output = strbuf_detach(&gpg_stderr, NULL);
387 sigc->gpg_status = strbuf_detach(&gpg_stdout, NULL);
388
389 parse_gpg_output(sigc);
390
391 strbuf_release(&gpg_stdout);
392 strbuf_release(&gpg_stderr);
393
394 return ret;
395}
396
397static void parse_ssh_output(struct signature_check *sigc)
398{
399 const char *line, *principal, *search;
400 char *to_free;
401 char *key = NULL;
402
403 /*
404 * ssh-keygen output should be:
405 * Good "git" signature for PRINCIPAL with RSA key SHA256:FINGERPRINT
406 *
407 * or for valid but unknown keys:
408 * Good "git" signature with RSA key SHA256:FINGERPRINT
409 *
410 * Note that "PRINCIPAL" can contain whitespace, "RSA" and
411 * "SHA256" part could be a different token that names of
412 * the algorithms used, and "FINGERPRINT" is a hexadecimal
413 * string. By finding the last occurrence of " with ", we can
414 * reliably parse out the PRINCIPAL.
415 */
416 sigc->result = 'B';
417 sigc->trust_level = TRUST_NEVER;
418
419 line = to_free = xmemdupz(sigc->output, strcspn(sigc->output, "\n"));
420
421 if (skip_prefix(line, "Good \"git\" signature for ", &line)) {
422 /* Search for the last "with" to get the full principal */
423 principal = line;
424 do {
425 search = strstr(line, " with ");
426 if (search)
427 line = search + 1;
428 } while (search != NULL);
429 if (line == principal)
430 goto cleanup;
431
432 /* Valid signature and known principal */
433 sigc->result = 'G';
434 sigc->trust_level = TRUST_FULLY;
435 sigc->signer = xmemdupz(principal, line - principal - 1);
436 } else if (skip_prefix(line, "Good \"git\" signature with ", &line)) {
437 /* Valid signature, but key unknown */
438 sigc->result = 'G';
439 sigc->trust_level = TRUST_UNDEFINED;
440 } else {
441 goto cleanup;
442 }
443
444 key = strstr(line, "key ");
445 if (key) {
446 sigc->fingerprint = xstrdup(strstr(line, "key ") + 4);
447 sigc->key = xstrdup(sigc->fingerprint);
448 } else {
449 /*
450 * Output did not match what we expected
451 * Treat the signature as bad
452 */
453 sigc->result = 'B';
454 }
455
456cleanup:
457 free(to_free);
458}
459
460static int verify_ssh_signed_buffer(struct signature_check *sigc,
461 struct gpg_format *fmt,
462 const char *signature,
463 size_t signature_size)
464{
465 struct child_process ssh_keygen = CHILD_PROCESS_INIT;
466 struct tempfile *buffer_file;
467 int ret = -1;
468 const char *line;
469 char *principal;
470 struct strbuf ssh_principals_out = STRBUF_INIT;
471 struct strbuf ssh_principals_err = STRBUF_INIT;
472 struct strbuf ssh_keygen_out = STRBUF_INIT;
473 struct strbuf ssh_keygen_err = STRBUF_INIT;
474 struct strbuf verify_time = STRBUF_INIT;
475 const struct date_mode verify_date_mode = {
476 .type = DATE_STRFTIME,
477 .strftime_fmt = "%Y%m%d%H%M%S",
478 /* SSH signing key validity has no timezone information - Use the local timezone */
479 .local = 1,
480 };
481
482 if (!ssh_allowed_signers) {
483 error(_("gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification"));
484 return -1;
485 }
486
487 buffer_file = mks_tempfile_t(".git_vtag_tmpXXXXXX");
488 if (!buffer_file)
489 return error_errno(_("could not create temporary file"));
490 if (write_in_full(buffer_file->fd, signature, signature_size) < 0 ||
491 close_tempfile_gently(buffer_file) < 0) {
492 error_errno(_("failed writing detached signature to '%s'"),
493 buffer_file->filename.buf);
494 delete_tempfile(&buffer_file);
495 return -1;
496 }
497
498 if (sigc->payload_timestamp)
499 strbuf_addf(&verify_time, "-Overify-time=%s",
500 show_date(sigc->payload_timestamp, 0, verify_date_mode));
501
502 /* Find the principal from the signers */
503 strvec_pushl(&ssh_keygen.args, fmt->program,
504 "-Y", "find-principals",
505 "-f", ssh_allowed_signers,
506 "-s", buffer_file->filename.buf,
507 verify_time.buf,
508 NULL);
509 ret = pipe_command(&ssh_keygen, NULL, 0, &ssh_principals_out, 0,
510 &ssh_principals_err, 0);
511 if (ret && strstr(ssh_principals_err.buf, "usage:")) {
512 error(_("ssh-keygen -Y find-principals/verify is needed for ssh signature verification (available in openssh version 8.2p1+)"));
513 goto out;
514 }
515 if (ret || !ssh_principals_out.len) {
516 /*
517 * We did not find a matching principal in the allowedSigners
518 * Check without validation
519 */
520 child_process_init(&ssh_keygen);
521 strvec_pushl(&ssh_keygen.args, fmt->program,
522 "-Y", "check-novalidate",
523 "-n", "git",
524 "-s", buffer_file->filename.buf,
525 verify_time.buf,
526 NULL);
527 pipe_command(&ssh_keygen, sigc->payload, sigc->payload_len,
528 &ssh_keygen_out, 0, &ssh_keygen_err, 0);
529
530 /*
531 * Fail on unknown keys
532 * we still call check-novalidate to display the signature info
533 */
534 ret = -1;
535 } else {
536 /* Check every principal we found (one per line) */
537 const char *next;
538 for (line = ssh_principals_out.buf;
539 *line;
540 line = next) {
541 const char *end_of_text;
542
543 next = end_of_text = strchrnul(line, '\n');
544
545 /* Did we find a LF, and did we have CR before it? */
546 if (*end_of_text &&
547 line < end_of_text &&
548 end_of_text[-1] == '\r')
549 end_of_text--;
550
551 /* Unless we hit NUL, skip over the LF we found */
552 if (*next)
553 next++;
554
555 /* Not all lines are data. Skip empty ones */
556 if (line == end_of_text)
557 continue;
558
559 /* We now know we have an non-empty line. Process it */
560 principal = xmemdupz(line, end_of_text - line);
561
562 child_process_init(&ssh_keygen);
563 strbuf_release(&ssh_keygen_out);
564 strbuf_release(&ssh_keygen_err);
565 strvec_push(&ssh_keygen.args, fmt->program);
566 /*
567 * We found principals
568 * Try with each until we find a match
569 */
570 strvec_pushl(&ssh_keygen.args, "-Y", "verify",
571 "-n", "git",
572 "-f", ssh_allowed_signers,
573 "-I", principal,
574 "-s", buffer_file->filename.buf,
575 verify_time.buf,
576 NULL);
577
578 if (ssh_revocation_file) {
579 if (file_exists(ssh_revocation_file)) {
580 strvec_pushl(&ssh_keygen.args, "-r",
581 ssh_revocation_file, NULL);
582 } else {
583 warning(_("ssh signing revocation file configured but not found: %s"),
584 ssh_revocation_file);
585 }
586 }
587
588 sigchain_push(SIGPIPE, SIG_IGN);
589 ret = pipe_command(&ssh_keygen, sigc->payload, sigc->payload_len,
590 &ssh_keygen_out, 0, &ssh_keygen_err, 0);
591 sigchain_pop(SIGPIPE);
592
593 FREE_AND_NULL(principal);
594
595 if (!ret)
596 ret = !starts_with(ssh_keygen_out.buf, "Good");
597
598 if (!ret)
599 break;
600 }
601 }
602
603 strbuf_stripspace(&ssh_keygen_out, NULL);
604 strbuf_stripspace(&ssh_keygen_err, NULL);
605 /* Add stderr outputs to show the user actual ssh-keygen errors */
606 strbuf_add(&ssh_keygen_out, ssh_principals_err.buf, ssh_principals_err.len);
607 strbuf_add(&ssh_keygen_out, ssh_keygen_err.buf, ssh_keygen_err.len);
608 sigc->output = strbuf_detach(&ssh_keygen_out, NULL);
609 sigc->gpg_status = xstrdup(sigc->output);
610
611 parse_ssh_output(sigc);
612
613out:
614 if (buffer_file)
615 delete_tempfile(&buffer_file);
616 strbuf_release(&ssh_principals_out);
617 strbuf_release(&ssh_principals_err);
618 strbuf_release(&ssh_keygen_out);
619 strbuf_release(&ssh_keygen_err);
620 strbuf_release(&verify_time);
621
622 return ret;
623}
624
625static int parse_payload_metadata(struct signature_check *sigc)
626{
627 const char *ident_line = NULL;
628 size_t ident_len;
629 struct ident_split ident;
630 const char *signer_header;
631
632 switch (sigc->payload_type) {
633 case SIGNATURE_PAYLOAD_COMMIT:
634 signer_header = "committer";
635 break;
636 case SIGNATURE_PAYLOAD_TAG:
637 signer_header = "tagger";
638 break;
639 case SIGNATURE_PAYLOAD_UNDEFINED:
640 case SIGNATURE_PAYLOAD_PUSH_CERT:
641 /* Ignore payloads we don't want to parse */
642 return 0;
643 default:
644 BUG("invalid value for sigc->payload_type");
645 }
646
647 ident_line = find_commit_header(sigc->payload, signer_header, &ident_len);
648 if (!ident_line || !ident_len)
649 return 1;
650
651 if (split_ident_line(&ident, ident_line, ident_len))
652 return 1;
653
654 if (!sigc->payload_timestamp && ident.date_begin && ident.date_end)
655 sigc->payload_timestamp = parse_timestamp(ident.date_begin, NULL, 10);
656
657 return 0;
658}
659
660int check_signature(struct signature_check *sigc,
661 const char *signature, size_t slen)
662{
663 struct gpg_format *fmt;
664 int status;
665
666 gpg_interface_lazy_init();
667
668 sigc->result = 'N';
669 sigc->trust_level = TRUST_UNDEFINED;
670
671 fmt = get_format_by_sig(signature);
672 if (!fmt)
673 die(_("bad/incompatible signature '%s'"), signature);
674
675 if (parse_payload_metadata(sigc))
676 return 1;
677
678 status = fmt->verify_signed_buffer(sigc, fmt, signature, slen);
679
680 if (status && !sigc->output)
681 return !!status;
682
683 status |= sigc->result != 'G';
684 status |= sigc->trust_level < configured_min_trust_level;
685
686 return !!status;
687}
688
689void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
690{
691 const char *output = flags & GPG_VERIFY_RAW ? sigc->gpg_status :
692 sigc->output;
693
694 if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
695 fwrite(sigc->payload, 1, sigc->payload_len, stdout);
696
697 if (output)
698 fputs(output, stderr);
699}
700
701size_t parse_signed_buffer(const char *buf, size_t size)
702{
703 size_t len = 0;
704 size_t match = size;
705 while (len < size) {
706 const char *eol;
707
708 if (get_format_by_sig(buf + len))
709 match = len;
710
711 eol = memchr(buf + len, '\n', size - len);
712 len += eol ? (size_t) (eol - (buf + len) + 1) : size - len;
713 }
714 return match;
715}
716
717int parse_signature(const char *buf, size_t size, struct strbuf *payload, struct strbuf *signature)
718{
719 size_t match = parse_signed_buffer(buf, size);
720 if (match != size) {
721 strbuf_add(payload, buf, match);
722 remove_signature(payload);
723 strbuf_add(signature, buf + match, size - match);
724 return 1;
725 }
726 return 0;
727}
728
729void set_signing_key(const char *key)
730{
731 gpg_interface_lazy_init();
732
733 free(configured_signing_key);
734 configured_signing_key = xstrdup(key);
735}
736
737static int git_gpg_config(const char *var, const char *value,
738 const struct config_context *ctx UNUSED,
739 void *cb UNUSED)
740{
741 struct gpg_format *fmt = NULL;
742 const char *fmtname = NULL;
743 char *trust;
744 int ret;
745
746 if (!strcmp(var, "user.signingkey")) {
747 if (!value)
748 return config_error_nonbool(var);
749 set_signing_key(value);
750 return 0;
751 }
752
753 if (!strcmp(var, "gpg.format")) {
754 if (!value)
755 return config_error_nonbool(var);
756 fmt = get_format_by_name(value);
757 if (!fmt)
758 return error(_("invalid value for '%s': '%s'"),
759 var, value);
760 use_format = fmt;
761 return 0;
762 }
763
764 if (!strcmp(var, "gpg.mintrustlevel")) {
765 if (!value)
766 return config_error_nonbool(var);
767
768 trust = xstrdup_toupper(value);
769 ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
770 free(trust);
771
772 if (ret)
773 return error(_("invalid value for '%s': '%s'"),
774 var, value);
775 return 0;
776 }
777
778 if (!strcmp(var, "gpg.ssh.defaultkeycommand"))
779 return git_config_string(&ssh_default_key_command, var, value);
780
781 if (!strcmp(var, "gpg.ssh.allowedsignersfile"))
782 return git_config_pathname(&ssh_allowed_signers, var, value);
783
784 if (!strcmp(var, "gpg.ssh.revocationfile"))
785 return git_config_pathname(&ssh_revocation_file, var, value);
786
787 if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
788 fmtname = "openpgp";
789
790 if (!strcmp(var, "gpg.x509.program"))
791 fmtname = "x509";
792
793 if (!strcmp(var, "gpg.ssh.program"))
794 fmtname = "ssh";
795
796 if (fmtname) {
797 fmt = get_format_by_name(fmtname);
798 return git_config_pathname((char **) &fmt->program, var, value);
799 }
800
801 return 0;
802}
803
804/*
805 * Returns 1 if `string` contains a literal ssh key, 0 otherwise
806 * `key` will be set to the start of the actual key if a prefix is present.
807 */
808static int is_literal_ssh_key(const char *string, const char **key)
809{
810 if (skip_prefix(string, "key::", key))
811 return 1;
812 if (starts_with(string, "ssh-")) {
813 *key = string;
814 return 1;
815 }
816 return 0;
817}
818
819static char *get_ssh_key_fingerprint(const char *signing_key)
820{
821 struct child_process ssh_keygen = CHILD_PROCESS_INIT;
822 int ret = -1;
823 struct strbuf fingerprint_stdout = STRBUF_INIT;
824 struct strbuf **fingerprint;
825 char *fingerprint_ret;
826 const char *literal_key = NULL;
827
828 /*
829 * With SSH Signing this can contain a filename or a public key
830 * For textual representation we usually want a fingerprint
831 */
832 if (is_literal_ssh_key(signing_key, &literal_key)) {
833 strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf", "-", NULL);
834 ret = pipe_command(&ssh_keygen, literal_key,
835 strlen(literal_key), &fingerprint_stdout, 0,
836 NULL, 0);
837 } else {
838 strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf",
839 configured_signing_key, NULL);
840 ret = pipe_command(&ssh_keygen, NULL, 0, &fingerprint_stdout, 0,
841 NULL, 0);
842 }
843
844 if (!!ret)
845 die_errno(_("failed to get the ssh fingerprint for key '%s'"),
846 signing_key);
847
848 fingerprint = strbuf_split_max(&fingerprint_stdout, ' ', 3);
849 if (!fingerprint[1])
850 die_errno(_("failed to get the ssh fingerprint for key '%s'"),
851 signing_key);
852
853 fingerprint_ret = strbuf_detach(fingerprint[1], NULL);
854 strbuf_list_free(fingerprint);
855 strbuf_release(&fingerprint_stdout);
856 return fingerprint_ret;
857}
858
859/* Returns the first public key from an ssh-agent to use for signing */
860static char *get_default_ssh_signing_key(void)
861{
862 struct child_process ssh_default_key = CHILD_PROCESS_INIT;
863 int ret = -1;
864 struct strbuf key_stdout = STRBUF_INIT, key_stderr = STRBUF_INIT;
865 struct strbuf **keys;
866 char *key_command = NULL;
867 const char **argv;
868 int n;
869 char *default_key = NULL;
870 const char *literal_key = NULL;
871
872 if (!ssh_default_key_command)
873 die(_("either user.signingkey or gpg.ssh.defaultKeyCommand needs to be configured"));
874
875 key_command = xstrdup(ssh_default_key_command);
876 n = split_cmdline(key_command, &argv);
877
878 if (n < 0)
879 die("malformed build-time gpg.ssh.defaultKeyCommand: %s",
880 split_cmdline_strerror(n));
881
882 strvec_pushv(&ssh_default_key.args, argv);
883 ret = pipe_command(&ssh_default_key, NULL, 0, &key_stdout, 0,
884 &key_stderr, 0);
885
886 if (!ret) {
887 keys = strbuf_split_max(&key_stdout, '\n', 2);
888 if (keys[0] && is_literal_ssh_key(keys[0]->buf, &literal_key)) {
889 /*
890 * We only use `is_literal_ssh_key` here to check validity
891 * The prefix will be stripped when the key is used.
892 */
893 default_key = strbuf_detach(keys[0], NULL);
894 } else {
895 warning(_("gpg.ssh.defaultKeyCommand succeeded but returned no keys: %s %s"),
896 key_stderr.buf, key_stdout.buf);
897 }
898
899 strbuf_list_free(keys);
900 } else {
901 warning(_("gpg.ssh.defaultKeyCommand failed: %s %s"),
902 key_stderr.buf, key_stdout.buf);
903 }
904
905 free(key_command);
906 free(argv);
907 strbuf_release(&key_stdout);
908
909 return default_key;
910}
911
912static char *get_ssh_key_id(void)
913{
914 char *signing_key = get_signing_key();
915 char *key_id = get_ssh_key_fingerprint(signing_key);
916 free(signing_key);
917 return key_id;
918}
919
920/* Returns a textual but unique representation of the signing key */
921char *get_signing_key_id(void)
922{
923 gpg_interface_lazy_init();
924
925 if (use_format->get_key_id) {
926 return use_format->get_key_id();
927 }
928
929 /* GPG/GPGSM only store a key id on this variable */
930 return get_signing_key();
931}
932
933char *get_signing_key(void)
934{
935 gpg_interface_lazy_init();
936
937 if (configured_signing_key)
938 return xstrdup(configured_signing_key);
939 if (use_format->get_default_key) {
940 return use_format->get_default_key();
941 }
942
943 return xstrdup(git_committer_info(IDENT_STRICT | IDENT_NO_DATE));
944}
945
946const char *gpg_trust_level_to_str(enum signature_trust_level level)
947{
948 struct sigcheck_gpg_trust_level *trust;
949
950 if (level < 0 || level >= ARRAY_SIZE(sigcheck_gpg_trust_level))
951 BUG("invalid trust level requested %d", level);
952
953 trust = &sigcheck_gpg_trust_level[level];
954 if (trust->value != level)
955 BUG("sigcheck_gpg_trust_level[] unsorted");
956
957 return sigcheck_gpg_trust_level[level].display_key;
958}
959
960int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
961{
962 gpg_interface_lazy_init();
963
964 return use_format->sign_buffer(buffer, signature, signing_key);
965}
966
967/*
968 * Strip CR from the line endings, in case we are on Windows.
969 * NEEDSWORK: make it trim only CRs before LFs and rename
970 */
971static void remove_cr_after(struct strbuf *buffer, size_t offset)
972{
973 size_t i, j;
974
975 for (i = j = offset; i < buffer->len; i++) {
976 if (buffer->buf[i] != '\r') {
977 if (i != j)
978 buffer->buf[j] = buffer->buf[i];
979 j++;
980 }
981 }
982 strbuf_setlen(buffer, j);
983}
984
985static int sign_buffer_gpg(struct strbuf *buffer, struct strbuf *signature,
986 const char *signing_key)
987{
988 struct child_process gpg = CHILD_PROCESS_INIT;
989 int ret;
990 size_t bottom;
991 const char *cp;
992 struct strbuf gpg_status = STRBUF_INIT;
993
994 strvec_pushl(&gpg.args,
995 use_format->program,
996 "--status-fd=2",
997 "-bsau", signing_key,
998 NULL);
999
1000 bottom = signature->len;
1001
1002 /*
1003 * When the username signingkey is bad, program could be terminated
1004 * because gpg exits without reading and then write gets SIGPIPE.
1005 */
1006 sigchain_push(SIGPIPE, SIG_IGN);
1007 ret = pipe_command(&gpg, buffer->buf, buffer->len,
1008 signature, 1024, &gpg_status, 0);
1009 sigchain_pop(SIGPIPE);
1010
1011 for (cp = gpg_status.buf;
1012 cp && (cp = strstr(cp, "[GNUPG:] SIG_CREATED "));
1013 cp++) {
1014 if (cp == gpg_status.buf || cp[-1] == '\n')
1015 break; /* found */
1016 }
1017 ret |= !cp;
1018 if (ret) {
1019 error(_("gpg failed to sign the data:\n%s"),
1020 gpg_status.len ? gpg_status.buf : "(no gpg output)");
1021 strbuf_release(&gpg_status);
1022 return -1;
1023 }
1024 strbuf_release(&gpg_status);
1025
1026 /* Strip CR from the line endings, in case we are on Windows. */
1027 remove_cr_after(signature, bottom);
1028
1029 return 0;
1030}
1031
1032static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
1033 const char *signing_key)
1034{
1035 struct child_process signer = CHILD_PROCESS_INIT;
1036 int ret = -1;
1037 size_t bottom, keylen;
1038 struct strbuf signer_stderr = STRBUF_INIT;
1039 struct tempfile *key_file = NULL, *buffer_file = NULL;
1040 char *ssh_signing_key_file = NULL;
1041 struct strbuf ssh_signature_filename = STRBUF_INIT;
1042 const char *literal_key = NULL;
1043 int literal_ssh_key = 0;
1044
1045 if (!signing_key || signing_key[0] == '\0')
1046 return error(
1047 _("user.signingKey needs to be set for ssh signing"));
1048
1049 if (is_literal_ssh_key(signing_key, &literal_key)) {
1050 /* A literal ssh key */
1051 literal_ssh_key = 1;
1052 key_file = mks_tempfile_t(".git_signing_key_tmpXXXXXX");
1053 if (!key_file)
1054 return error_errno(
1055 _("could not create temporary file"));
1056 keylen = strlen(literal_key);
1057 if (write_in_full(key_file->fd, literal_key, keylen) < 0 ||
1058 close_tempfile_gently(key_file) < 0) {
1059 error_errno(_("failed writing ssh signing key to '%s'"),
1060 key_file->filename.buf);
1061 goto out;
1062 }
1063 ssh_signing_key_file = xstrdup(key_file->filename.buf);
1064 } else {
1065 /* We assume a file */
1066 ssh_signing_key_file = interpolate_path(signing_key, 1);
1067 }
1068
1069 buffer_file = mks_tempfile_t(".git_signing_buffer_tmpXXXXXX");
1070 if (!buffer_file) {
1071 error_errno(_("could not create temporary file"));
1072 goto out;
1073 }
1074
1075 if (write_in_full(buffer_file->fd, buffer->buf, buffer->len) < 0 ||
1076 close_tempfile_gently(buffer_file) < 0) {
1077 error_errno(_("failed writing ssh signing key buffer to '%s'"),
1078 buffer_file->filename.buf);
1079 goto out;
1080 }
1081
1082 strvec_pushl(&signer.args, use_format->program,
1083 "-Y", "sign",
1084 "-n", "git",
1085 "-f", ssh_signing_key_file,
1086 NULL);
1087 if (literal_ssh_key)
1088 strvec_push(&signer.args, "-U");
1089 strvec_push(&signer.args, buffer_file->filename.buf);
1090
1091 sigchain_push(SIGPIPE, SIG_IGN);
1092 ret = pipe_command(&signer, NULL, 0, NULL, 0, &signer_stderr, 0);
1093 sigchain_pop(SIGPIPE);
1094
1095 if (ret) {
1096 if (strstr(signer_stderr.buf, "usage:"))
1097 error(_("ssh-keygen -Y sign is needed for ssh signing (available in openssh version 8.2p1+)"));
1098
1099 ret = error("%s", signer_stderr.buf);
1100 goto out;
1101 }
1102
1103 bottom = signature->len;
1104
1105 strbuf_addbuf(&ssh_signature_filename, &buffer_file->filename);
1106 strbuf_addstr(&ssh_signature_filename, ".sig");
1107 if (strbuf_read_file(signature, ssh_signature_filename.buf, 0) < 0) {
1108 ret = error_errno(
1109 _("failed reading ssh signing data buffer from '%s'"),
1110 ssh_signature_filename.buf);
1111 goto out;
1112 }
1113 /* Strip CR from the line endings, in case we are on Windows. */
1114 remove_cr_after(signature, bottom);
1115
1116out:
1117 if (key_file)
1118 delete_tempfile(&key_file);
1119 if (buffer_file)
1120 delete_tempfile(&buffer_file);
1121 if (ssh_signature_filename.len)
1122 unlink_or_warn(ssh_signature_filename.buf);
1123 strbuf_release(&signer_stderr);
1124 strbuf_release(&ssh_signature_filename);
1125 FREE_AND_NULL(ssh_signing_key_file);
1126 return ret;
1127}
1128
1129int parse_sign_mode(const char *arg, enum sign_mode *mode)
1130{
1131 if (!strcmp(arg, "abort"))
1132 *mode = SIGN_ABORT;
1133 else if (!strcmp(arg, "verbatim") || !strcmp(arg, "ignore"))
1134 *mode = SIGN_VERBATIM;
1135 else if (!strcmp(arg, "warn-verbatim") || !strcmp(arg, "warn"))
1136 *mode = SIGN_WARN_VERBATIM;
1137 else if (!strcmp(arg, "warn-strip"))
1138 *mode = SIGN_WARN_STRIP;
1139 else if (!strcmp(arg, "strip"))
1140 *mode = SIGN_STRIP;
1141 else
1142 return -1;
1143 return 0;
1144}