merge/pull Check for untrusted good GPG signatures

When --verify-signatures is specified, abort the merge in case a good
GPG signature from an untrusted key is encountered.

Signed-off-by: Sebastian Götte <jaseg@physik-pool.tu-berlin.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/Documentation/merge-options.txt b/Documentation/merge-options.txt
index 31f106752152ea0a915ceaea148cf4cad555de99..a0f022b41df07b3f2d431a9f284d63ce040a55ad 100644 (file)
--- a/Documentation/merge-options.txt
+++ b/Documentation/merge-options.txt
@@ -85,8 +85,8 @@ option can be used to override --squash.
 
 --verify-signatures::
 --no-verify-signatures::
-       Verify that the commits being merged have good GPG signatures and abort the
-       merge in case they do not.
+       Verify that the commits being merged have good and trusted GPG signatures
+       and abort the merge in case they do not.
 
 --summary::
 --no-summary::

diff --git a/builtin/merge.c b/builtin/merge.c
index e57c42c622b0d92c08bebf8eca8560503fe78b80..bac11d1605c51d558dc18d7d2e67470b79a39d2d 100644 (file)
--- a/builtin/merge.c
+++ b/builtin/merge.c
@@ -1248,6 +1248,9 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
                        switch (signature_check.result) {
                        case 'G':
                                break;
+                       case 'U':
+                               die(_("Commit %s has an untrusted GPG signature, "
+                                     "allegedly by %s."), hex, signature_check.signer);
                        case 'B':
                                die(_("Commit %s has a bad GPG signature "
                                      "allegedly by %s."), hex, signature_check.signer);

diff --git a/commit.c b/commit.c
index 94029c949653693a78fd2ecfb15d98cbebd517c9..516a4ff7d21d5ebcfabda7b1b886eb10b05cebfc 100644 (file)
--- a/commit.c
+++ b/commit.c
@@ -1047,6 +1047,8 @@ static struct {
 } sigcheck_gpg_status[] = {
        { 'G', "\n[GNUPG:] GOODSIG " },
        { 'B', "\n[GNUPG:] BADSIG " },
+       { 'U', "\n[GNUPG:] TRUST_NEVER" },
+       { 'U', "\n[GNUPG:] TRUST_UNDEFINED" },
 };
 
 static void parse_gpg_output(struct signature_check *sigc)
@@ -1068,11 +1070,13 @@ static void parse_gpg_output(struct signature_check *sigc)
                        found += strlen(sigcheck_gpg_status[i].check);
                }
                sigc->result = sigcheck_gpg_status[i].result;
-               sigc->key = xmemdupz(found, 16);
-               found += 17;
-               next = strchrnul(found, '\n');
-               sigc->signer = xmemdupz(found, next - found);
-               break;
+               /* The trust messages are not followed by key/signer information */
+               if (sigc->result != 'U') {
+                       sigc->key = xmemdupz(found, 16);
+                       found += 17;
+                       next = strchrnul(found, '\n');
+                       sigc->signer = xmemdupz(found, next - found);
+               }
        }
 }
 

diff --git a/commit.h b/commit.h
index c24b844ad64167e88047d07198be273bba284663..87b4b6cc0c036d4b7d2ff67cf9d6e98c58f13793 100644 (file)
--- a/commit.h
+++ b/commit.h
@@ -234,11 +234,11 @@ extern void print_commit_list(struct commit_list *list,
                              const char *format_last);
 
 /*
- * Check the signature of the given commit. The result of the check is stored in
- * sig->result, 'G' for a good signature, 'B' for a bad signature and 'N'
- * for no signature at all.
- * This may allocate memory for sig->gpg_output, sig->gpg_status, sig->signer
- * and sig->key.
+ * Check the signature of the given commit. The result of the check is stored
+ * in sig->check_result, 'G' for a good signature, 'U' for a good signature
+ * from an untrusted signer, 'B' for a bad signature and 'N' for no signature
+ * at all.  This may allocate memory for sig->gpg_output, sig->gpg_status,
+ * sig->signer and sig->key.
  */
 extern void check_commit_signature(const struct commit* commit, struct signature_check *sigc);
 

diff --git a/gpg-interface.h b/gpg-interface.h
index 5884aa405293dcb9949c627fb630993dbb5ff857..a85cb5bc97cdd61000b4c48c54faa656aa3cfaca 100644 (file)
--- a/gpg-interface.h
+++ b/gpg-interface.h
@@ -6,6 +6,7 @@ struct signature_check {
        char *gpg_status;
        char result; /* 0 (not checked),
                      * N (checked but no further result),
+                     * U (untrusted good),
                      * G (good)
                      * B (bad) */
        char *signer;

diff --git a/t/lib-gpg/pubring.gpg b/t/lib-gpg/pubring.gpg
index 83855fa4e1c6c37afe550c17afa1e7971042ded5..1a3c2d487c2fda9169751a3068fa51e853a1e519 100644 (file)
Binary files a/t/lib-gpg/pubring.gpg and b/t/lib-gpg/pubring.gpg differ

diff --git a/t/lib-gpg/random_seed b/t/lib-gpg/random_seed
index 8fed1339ed0a744e5663f4a5e6b6ac9bae3d8524..95d249f15fce980f0e8c1a8a18b085b3885708aa 100644 (file)
Binary files a/t/lib-gpg/random_seed and b/t/lib-gpg/random_seed differ

diff --git a/t/lib-gpg/secring.gpg b/t/lib-gpg/secring.gpg
index d831cd9eb3eee613d3c0e1a71093ae01ea7347e3..82dca8f80bf170fde5705862c3eeb9d994725042 100644 (file)
Binary files a/t/lib-gpg/secring.gpg and b/t/lib-gpg/secring.gpg differ

diff --git a/t/lib-gpg/trustdb.gpg b/t/lib-gpg/trustdb.gpg
index abace962b8bf84be688a6f27e4ebd0ee7052f210..4879ae9a84650a93a4d15bd6560c5d1b89eb4c2f 100644 (file)
Binary files a/t/lib-gpg/trustdb.gpg and b/t/lib-gpg/trustdb.gpg differ

diff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh
index 6ccfbf367aa2b52e9fdb42ade6b23b0292171715..21a0bf8fb8c4946f625b317a9d60aa05bb0acb65 100755 (executable)
--- a/t/t7612-merge-verify-signatures.sh
+++ b/t/t7612-merge-verify-signatures.sh
@@ -27,6 +27,10 @@ test_expect_success GPG 'create signed commits' '
        git hash-object -w -t commit forged >forged.commit &&
        git checkout initial &&
 
+       git checkout -b side-untrusted &&
+       echo 3 >baz && git add baz &&
+       test_tick && git commit -SB7227189 -m "untrusted on side"
+
        git checkout master
 '
 
@@ -40,6 +44,11 @@ test_expect_success GPG 'merge commit with bad signature with verification' '
        test_i18ngrep "has a bad GPG signature" mergeerror
 '
 
+test_expect_success GPG 'merge commit with untrusted signature with verification' '
+       test_must_fail git merge --ff-only --verify-signatures side-untrusted 2>mergeerror &&
+       test_i18ngrep "has an untrusted GPG signature" mergeerror
+'
+
 test_expect_success GPG 'merge signed commit with verification' '
        git merge --verbose --ff-only --verify-signatures side-signed >mergeoutput &&
        test_i18ngrep "has a good GPG signature" mergeoutput