Sync with Git 2.25.2
[git] / gpg-interface.c
1 #include "cache.h"
2 #include "config.h"
3 #include "run-command.h"
4 #include "strbuf.h"
5 #include "gpg-interface.h"
6 #include "sigchain.h"
7 #include "tempfile.h"
8
9 static char *configured_signing_key;
10 static enum signature_trust_level configured_min_trust_level = TRUST_UNDEFINED;
11
12 struct gpg_format {
13         const char *name;
14         const char *program;
15         const char **verify_args;
16         const char **sigs;
17 };
18
19 static const char *openpgp_verify_args[] = {
20         "--keyid-format=long",
21         NULL
22 };
23 static const char *openpgp_sigs[] = {
24         "-----BEGIN PGP SIGNATURE-----",
25         "-----BEGIN PGP MESSAGE-----",
26         NULL
27 };
28
29 static const char *x509_verify_args[] = {
30         NULL
31 };
32 static const char *x509_sigs[] = {
33         "-----BEGIN SIGNED MESSAGE-----",
34         NULL
35 };
36
37 static struct gpg_format gpg_format[] = {
38         { .name = "openpgp", .program = "gpg",
39           .verify_args = openpgp_verify_args,
40           .sigs = openpgp_sigs
41         },
42         { .name = "x509", .program = "gpgsm",
43           .verify_args = x509_verify_args,
44           .sigs = x509_sigs
45         },
46 };
47
48 static struct gpg_format *use_format = &gpg_format[0];
49
50 static struct gpg_format *get_format_by_name(const char *str)
51 {
52         int i;
53
54         for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
55                 if (!strcmp(gpg_format[i].name, str))
56                         return gpg_format + i;
57         return NULL;
58 }
59
60 static struct gpg_format *get_format_by_sig(const char *sig)
61 {
62         int i, j;
63
64         for (i = 0; i < ARRAY_SIZE(gpg_format); i++)
65                 for (j = 0; gpg_format[i].sigs[j]; j++)
66                         if (starts_with(sig, gpg_format[i].sigs[j]))
67                                 return gpg_format + i;
68         return NULL;
69 }
70
71 void signature_check_clear(struct signature_check *sigc)
72 {
73         FREE_AND_NULL(sigc->payload);
74         FREE_AND_NULL(sigc->gpg_output);
75         FREE_AND_NULL(sigc->gpg_status);
76         FREE_AND_NULL(sigc->signer);
77         FREE_AND_NULL(sigc->key);
78         FREE_AND_NULL(sigc->fingerprint);
79         FREE_AND_NULL(sigc->primary_key_fingerprint);
80 }
81
82 /* An exclusive status -- only one of them can appear in output */
83 #define GPG_STATUS_EXCLUSIVE    (1<<0)
84 /* The status includes key identifier */
85 #define GPG_STATUS_KEYID        (1<<1)
86 /* The status includes user identifier */
87 #define GPG_STATUS_UID          (1<<2)
88 /* The status includes key fingerprints */
89 #define GPG_STATUS_FINGERPRINT  (1<<3)
90 /* The status includes trust level */
91 #define GPG_STATUS_TRUST_LEVEL  (1<<4)
92
93 /* Short-hand for standard exclusive *SIG status with keyid & UID */
94 #define GPG_STATUS_STDSIG       (GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID|GPG_STATUS_UID)
95
96 static struct {
97         char result;
98         const char *check;
99         unsigned int flags;
100 } sigcheck_gpg_status[] = {
101         { 'G', "GOODSIG ", GPG_STATUS_STDSIG },
102         { 'B', "BADSIG ", GPG_STATUS_STDSIG },
103         { 'E', "ERRSIG ", GPG_STATUS_EXCLUSIVE|GPG_STATUS_KEYID },
104         { 'X', "EXPSIG ", GPG_STATUS_STDSIG },
105         { 'Y', "EXPKEYSIG ", GPG_STATUS_STDSIG },
106         { 'R', "REVKEYSIG ", GPG_STATUS_STDSIG },
107         { 0, "VALIDSIG ", GPG_STATUS_FINGERPRINT },
108         { 0, "TRUST_", GPG_STATUS_TRUST_LEVEL },
109 };
110
111 static struct {
112         const char *key;
113         enum signature_trust_level value;
114 } sigcheck_gpg_trust_level[] = {
115         { "UNDEFINED", TRUST_UNDEFINED },
116         { "NEVER", TRUST_NEVER },
117         { "MARGINAL", TRUST_MARGINAL },
118         { "FULLY", TRUST_FULLY },
119         { "ULTIMATE", TRUST_ULTIMATE },
120 };
121
122 static void replace_cstring(char **field, const char *line, const char *next)
123 {
124         free(*field);
125
126         if (line && next)
127                 *field = xmemdupz(line, next - line);
128         else
129                 *field = NULL;
130 }
131
132 static int parse_gpg_trust_level(const char *level,
133                                  enum signature_trust_level *res)
134 {
135         size_t i;
136
137         for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_trust_level); i++) {
138                 if (!strcmp(sigcheck_gpg_trust_level[i].key, level)) {
139                         *res = sigcheck_gpg_trust_level[i].value;
140                         return 0;
141                 }
142         }
143         return 1;
144 }
145
146 static void parse_gpg_output(struct signature_check *sigc)
147 {
148         const char *buf = sigc->gpg_status;
149         const char *line, *next;
150         int i, j;
151         int seen_exclusive_status = 0;
152
153         /* Iterate over all lines */
154         for (line = buf; *line; line = strchrnul(line+1, '\n')) {
155                 while (*line == '\n')
156                         line++;
157                 if (!*line)
158                         break;
159
160                 /* Skip lines that don't start with GNUPG status */
161                 if (!skip_prefix(line, "[GNUPG:] ", &line))
162                         continue;
163
164                 /* Iterate over all search strings */
165                 for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
166                         if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
167                                 /*
168                                  * GOODSIG, BADSIG etc. can occur only once for
169                                  * each signature.  Therefore, if we had more
170                                  * than one then we're dealing with multiple
171                                  * signatures.  We don't support them
172                                  * currently, and they're rather hard to
173                                  * create, so something is likely fishy and we
174                                  * should reject them altogether.
175                                  */
176                                 if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
177                                         if (seen_exclusive_status++)
178                                                 goto error;
179                                 }
180
181                                 if (sigcheck_gpg_status[i].result)
182                                         sigc->result = sigcheck_gpg_status[i].result;
183                                 /* Do we have key information? */
184                                 if (sigcheck_gpg_status[i].flags & GPG_STATUS_KEYID) {
185                                         next = strchrnul(line, ' ');
186                                         replace_cstring(&sigc->key, line, next);
187                                         /* Do we have signer information? */
188                                         if (*next && (sigcheck_gpg_status[i].flags & GPG_STATUS_UID)) {
189                                                 line = next + 1;
190                                                 next = strchrnul(line, '\n');
191                                                 replace_cstring(&sigc->signer, line, next);
192                                         }
193                                 }
194
195                                 /* Do we have trust level? */
196                                 if (sigcheck_gpg_status[i].flags & GPG_STATUS_TRUST_LEVEL) {
197                                         /*
198                                          * GPG v1 and v2 differs in how the
199                                          * TRUST_ lines are written.  Some
200                                          * trust lines contain no additional
201                                          * space-separated information for v1.
202                                          */
203                                         size_t trust_size = strcspn(line, " \n");
204                                         char *trust = xmemdupz(line, trust_size);
205
206                                         if (parse_gpg_trust_level(trust, &sigc->trust_level)) {
207                                                 free(trust);
208                                                 goto error;
209                                         }
210                                         free(trust);
211                                 }
212
213                                 /* Do we have fingerprint? */
214                                 if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
215                                         const char *limit;
216                                         char **field;
217
218                                         next = strchrnul(line, ' ');
219                                         replace_cstring(&sigc->fingerprint, line, next);
220
221                                         /*
222                                          * Skip interim fields.  The search is
223                                          * limited to the same line since only
224                                          * OpenPGP signatures has a field with
225                                          * the primary fingerprint.
226                                          */
227                                         limit = strchrnul(line, '\n');
228                                         for (j = 9; j > 0; j--) {
229                                                 if (!*next || limit <= next)
230                                                         break;
231                                                 line = next + 1;
232                                                 next = strchrnul(line, ' ');
233                                         }
234
235                                         field = &sigc->primary_key_fingerprint;
236                                         if (!j) {
237                                                 next = strchrnul(line, '\n');
238                                                 replace_cstring(field, line, next);
239                                         } else {
240                                                 replace_cstring(field, NULL, NULL);
241                                         }
242                                 }
243
244                                 break;
245                         }
246                 }
247         }
248         return;
249
250 error:
251         sigc->result = 'E';
252         /* Clear partial data to avoid confusion */
253         FREE_AND_NULL(sigc->primary_key_fingerprint);
254         FREE_AND_NULL(sigc->fingerprint);
255         FREE_AND_NULL(sigc->signer);
256         FREE_AND_NULL(sigc->key);
257 }
258
259 int check_signature(const char *payload, size_t plen, const char *signature,
260         size_t slen, struct signature_check *sigc)
261 {
262         struct strbuf gpg_output = STRBUF_INIT;
263         struct strbuf gpg_status = STRBUF_INIT;
264         int status;
265
266         sigc->result = 'N';
267         sigc->trust_level = -1;
268
269         status = verify_signed_buffer(payload, plen, signature, slen,
270                                       &gpg_output, &gpg_status);
271         if (status && !gpg_output.len)
272                 goto out;
273         sigc->payload = xmemdupz(payload, plen);
274         sigc->gpg_output = strbuf_detach(&gpg_output, NULL);
275         sigc->gpg_status = strbuf_detach(&gpg_status, NULL);
276         parse_gpg_output(sigc);
277         status |= sigc->result != 'G';
278         status |= sigc->trust_level < configured_min_trust_level;
279
280  out:
281         strbuf_release(&gpg_status);
282         strbuf_release(&gpg_output);
283
284         return !!status;
285 }
286
287 void print_signature_buffer(const struct signature_check *sigc, unsigned flags)
288 {
289         const char *output = flags & GPG_VERIFY_RAW ?
290                 sigc->gpg_status : sigc->gpg_output;
291
292         if (flags & GPG_VERIFY_VERBOSE && sigc->payload)
293                 fputs(sigc->payload, stdout);
294
295         if (output)
296                 fputs(output, stderr);
297 }
298
299 size_t parse_signature(const char *buf, size_t size)
300 {
301         size_t len = 0;
302         size_t match = size;
303         while (len < size) {
304                 const char *eol;
305
306                 if (get_format_by_sig(buf + len))
307                         match = len;
308
309                 eol = memchr(buf + len, '\n', size - len);
310                 len += eol ? eol - (buf + len) + 1 : size - len;
311         }
312         return match;
313 }
314
315 void set_signing_key(const char *key)
316 {
317         free(configured_signing_key);
318         configured_signing_key = xstrdup(key);
319 }
320
321 int git_gpg_config(const char *var, const char *value, void *cb)
322 {
323         struct gpg_format *fmt = NULL;
324         char *fmtname = NULL;
325         char *trust;
326         int ret;
327
328         if (!strcmp(var, "user.signingkey")) {
329                 if (!value)
330                         return config_error_nonbool(var);
331                 set_signing_key(value);
332                 return 0;
333         }
334
335         if (!strcmp(var, "gpg.format")) {
336                 if (!value)
337                         return config_error_nonbool(var);
338                 fmt = get_format_by_name(value);
339                 if (!fmt)
340                         return error("unsupported value for %s: %s",
341                                      var, value);
342                 use_format = fmt;
343                 return 0;
344         }
345
346         if (!strcmp(var, "gpg.mintrustlevel")) {
347                 if (!value)
348                         return config_error_nonbool(var);
349
350                 trust = xstrdup_toupper(value);
351                 ret = parse_gpg_trust_level(trust, &configured_min_trust_level);
352                 free(trust);
353
354                 if (ret)
355                         return error("unsupported value for %s: %s", var,
356                                      value);
357                 return 0;
358         }
359
360         if (!strcmp(var, "gpg.program") || !strcmp(var, "gpg.openpgp.program"))
361                 fmtname = "openpgp";
362
363         if (!strcmp(var, "gpg.x509.program"))
364                 fmtname = "x509";
365
366         if (fmtname) {
367                 fmt = get_format_by_name(fmtname);
368                 return git_config_string(&fmt->program, var, value);
369         }
370
371         return 0;
372 }
373
374 const char *get_signing_key(void)
375 {
376         if (configured_signing_key)
377                 return configured_signing_key;
378         return git_committer_info(IDENT_STRICT|IDENT_NO_DATE);
379 }
380
381 int sign_buffer(struct strbuf *buffer, struct strbuf *signature, const char *signing_key)
382 {
383         struct child_process gpg = CHILD_PROCESS_INIT;
384         int ret;
385         size_t i, j, bottom;
386         struct strbuf gpg_status = STRBUF_INIT;
387
388         argv_array_pushl(&gpg.args,
389                          use_format->program,
390                          "--status-fd=2",
391                          "-bsau", signing_key,
392                          NULL);
393
394         bottom = signature->len;
395
396         /*
397          * When the username signingkey is bad, program could be terminated
398          * because gpg exits without reading and then write gets SIGPIPE.
399          */
400         sigchain_push(SIGPIPE, SIG_IGN);
401         ret = pipe_command(&gpg, buffer->buf, buffer->len,
402                            signature, 1024, &gpg_status, 0);
403         sigchain_pop(SIGPIPE);
404
405         ret |= !strstr(gpg_status.buf, "\n[GNUPG:] SIG_CREATED ");
406         strbuf_release(&gpg_status);
407         if (ret)
408                 return error(_("gpg failed to sign the data"));
409
410         /* Strip CR from the line endings, in case we are on Windows. */
411         for (i = j = bottom; i < signature->len; i++)
412                 if (signature->buf[i] != '\r') {
413                         if (i != j)
414                                 signature->buf[j] = signature->buf[i];
415                         j++;
416                 }
417         strbuf_setlen(signature, j);
418
419         return 0;
420 }
421
422 int verify_signed_buffer(const char *payload, size_t payload_size,
423                          const char *signature, size_t signature_size,
424                          struct strbuf *gpg_output, struct strbuf *gpg_status)
425 {
426         struct child_process gpg = CHILD_PROCESS_INIT;
427         struct gpg_format *fmt;
428         struct tempfile *temp;
429         int ret;
430         struct strbuf buf = STRBUF_INIT;
431
432         temp = mks_tempfile_t(".git_vtag_tmpXXXXXX");
433         if (!temp)
434                 return error_errno(_("could not create temporary file"));
435         if (write_in_full(temp->fd, signature, signature_size) < 0 ||
436             close_tempfile_gently(temp) < 0) {
437                 error_errno(_("failed writing detached signature to '%s'"),
438                             temp->filename.buf);
439                 delete_tempfile(&temp);
440                 return -1;
441         }
442
443         fmt = get_format_by_sig(signature);
444         if (!fmt)
445                 BUG("bad signature '%s'", signature);
446
447         argv_array_push(&gpg.args, fmt->program);
448         argv_array_pushv(&gpg.args, fmt->verify_args);
449         argv_array_pushl(&gpg.args,
450                          "--status-fd=1",
451                          "--verify", temp->filename.buf, "-",
452                          NULL);
453
454         if (!gpg_status)
455                 gpg_status = &buf;
456
457         sigchain_push(SIGPIPE, SIG_IGN);
458         ret = pipe_command(&gpg, payload, payload_size,
459                            gpg_status, 0, gpg_output, 0);
460         sigchain_pop(SIGPIPE);
461
462         delete_tempfile(&temp);
463
464         ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
465         strbuf_release(&buf); /* no matter it was used or not */
466
467         return ret;
468 }