{"thread":{"id":"48644","subject":"[PATCH 1/2] t7510-signed-commit: use 'test_must_fail'","startedAt":"2018-06-04T13:39:35Z","lastAt":"2018-06-04T22:33:45Z","messageCount":3,"participants":["SZEDER Gábor","brian m. carlson"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"349240","messageId":"20180604133926.16558-1-szeder.dev@gmail.com","threadId":"48644","inReplyTo":null,"subject":"[PATCH 1/2] t7510-signed-commit: use 'test_must_fail'","fromName":"SZEDER Gábor","fromEmail":"szeder.dev@gmail.com","sentAt":"2018-06-04T13:39:25Z","receivedAt":"2018-06-04T13:39:35Z","isPatch":true,"sender":{"key":"szeder.dev@gmail.com","avatar":"https://avatars.githubusercontent.com/u/116324?v=4"},"body":"The two tests 'detect fudged signature' and 'detect fudged signature\nwith NUL' in 't7510-signed-commit.sh' check that 'git verify-commit'\nerrors out when encountering a forged commit, but they do so by\nrunning\n\n  ! git verify-commit ...\n\nUse 'test_must_fail' instead, because that would catch potential\nunexpected errors like a segfault as well.\n\nSigned-off-by: SZEDER Gábor <szeder.dev@gmail.com>\n---\n t/t7510-signed-commit.sh | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/t/t7510-signed-commit.sh b/t/t7510-signed-commit.sh\nindex 762135adea..663bf68def 100755\n--- a/t/t7510-signed-commit.sh\n+++ b/t/t7510-signed-commit.sh\n@@ -145,7 +145,7 @@ test_expect_success GPG 'detect fudged signature' '\n \n \tsed -e \"s/seventh/7th forged/\" raw >forged1 &&\n \tgit hash-object -w -t commit forged1 >forged1.commit &&\n-\t! git verify-commit $(cat forged1.commit) &&\n+\ttest_must_fail git verify-commit $(cat forged1.commit) &&\n \tgit show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&\n \tgrep \"BAD signature from\" actual1 &&\n \t! grep \"Good signature from\" actual1\n@@ -156,7 +156,7 @@ test_expect_success GPG 'detect fudged signature with NUL' '\n \tcat raw >forged2 &&\n \techo Qwik | tr \"Q\" \"\\000\" >>forged2 &&\n \tgit hash-object -w -t commit forged2 >forged2.commit &&\n-\t! git verify-commit $(cat forged2.commit) &&\n+\ttest_must_fail git verify-commit $(cat forged2.commit) &&\n \tgit show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&\n \tgrep \"BAD signature from\" actual2 &&\n \t! grep \"Good signature from\" actual2\n-- \n2.18.0.rc0.207.ga6211da864\n\n"},{"id":"349241","messageId":"20180604133926.16558-2-szeder.dev@gmail.com","threadId":"48644","inReplyTo":"20180604133926.16558-1-szeder.dev@gmail.com","subject":"[PATCH 2/2] tests: make forging GPG signed commits and tags more robust","fromName":"SZEDER Gábor","fromEmail":"szeder.dev@gmail.com","sentAt":"2018-06-04T13:39:26Z","receivedAt":"2018-06-04T13:39:37Z","isPatch":true,"sender":{"key":"szeder.dev@gmail.com","avatar":"https://avatars.githubusercontent.com/u/116324?v=4"},"body":"A couple of test scripts create forged GPG signed commits or tags to\ncheck that such forgery can't fool various git commands' signature\nverification.  All but one of those test scripts are prone to\noccasional failures because the forgery creates a bogus GPG signature,\nand git commands error out with an unexpected error message, e.g.\n\"Commit deadbeef does not have a GPG signature\" instead of \"...  has a\nbad GPG signature\".\n\n't5573-pull-verify-signatures.sh', 't7510-signed-commit.sh' and\n't7612-merge-verify-signatures.sh' create forged signed commits like\nthis:\n\n  git commit -S -m \"bad on side\" &&\n  git cat-file commit side-bad >raw &&\n  sed -e \"s/bad/forged bad/\" raw >forged &&\n  git hash-object -w -t commit forged >forged.commit\n\nOn rare occasions the given pattern occurs not only in the commit\nmessage but in the GPG signature as well, and after it's replaced in\nthe signature the resulting signature becomes invalid, GPG will report\nCRC error and that it couldn't find any signature, which will then\nultimately cause the test failure.\n\nSince in all three cases the pattern to be replaced during the forgery\nis the first word of the commit message's subject line, and since the\nGPG signature in the commit object is indented by a space, let's just\nanchor those patterns to the beginning of the line to prevent this\nissue.\n\nThe test script 't7030-verify-tag.sh' creates a forged signed tag\nobject in a similar way by replacing the pattern \"seventh\", but the\nGPG signature in tag objects is not indented by a space, so the above\nsolution is not applicable in this case.  However, in the tag object\nin question the pattern \"seventh\" occurs not only in the tag message\nbut in the 'tag' header as well.  To create a forged tag object it's\nsufficient to replace only one of the two occurences, so modify the\nsed script to limit the pattern to the 'tag' header (i.e. a line\nbeginning with \"tag \", which, because of the space character, can\nnever occur in the base64-encoded GPG signature).\n\nNote that the forgery in 't7004-tag.sh' is not affected by this issue:\nwhile 't7004' does create a forged signed tag kind of the same way,\nit replaces \"signed-tag\" in the tag object, which, because of the '-'\ncharacter, can never occur in the base64-encoded GPG signarute.\n\nSigned-off-by: SZEDER Gábor <szeder.dev@gmail.com>\n---\n t/t5573-pull-verify-signatures.sh  | 2 +-\n t/t7030-verify-tag.sh              | 2 +-\n t/t7510-signed-commit.sh           | 3 +--\n t/t7612-merge-verify-signatures.sh | 2 +-\n 4 files changed, 4 insertions(+), 5 deletions(-)\n\ndiff --git a/t/t5573-pull-verify-signatures.sh b/t/t5573-pull-verify-signatures.sh\nindex 9594e891f4..747775c147 100755\n--- a/t/t5573-pull-verify-signatures.sh\n+++ b/t/t5573-pull-verify-signatures.sh\n@@ -29,7 +29,7 @@ test_expect_success GPG 'create repositories with signed commits' '\n \t\techo 4 >d && git add d &&\n \t\ttest_tick && git commit -S -m \"bad\" &&\n \t\tgit cat-file commit HEAD >raw &&\n-\t\tsed -e \"s/bad/forged bad/\" raw >forged &&\n+\t\tsed -e \"s/^bad/forged bad/\" raw >forged &&\n \t\tgit hash-object -w -t commit forged >forged.commit &&\n \t\tgit checkout $(cat forged.commit)\n \t) &&\ndiff --git a/t/t7030-verify-tag.sh b/t/t7030-verify-tag.sh\nindex b4b49eeb08..291a1e2b07 100755\n--- a/t/t7030-verify-tag.sh\n+++ b/t/t7030-verify-tag.sh\n@@ -74,7 +74,7 @@ test_expect_success GPG 'verify and show signatures' '\n \n test_expect_success GPG 'detect fudged signature' '\n \tgit cat-file tag seventh-signed >raw &&\n-\tsed -e \"s/seventh/7th forged/\" raw >forged1 &&\n+\tsed -e \"/^tag / s/seventh/7th forged/\" raw >forged1 &&\n \tgit hash-object -w -t tag forged1 >forged1.tag &&\n \ttest_must_fail git verify-tag $(cat forged1.tag) 2>actual1 &&\n \tgrep \"BAD signature from\" actual1 &&\ndiff --git a/t/t7510-signed-commit.sh b/t/t7510-signed-commit.sh\nindex 663bf68def..6e2015ed9a 100755\n--- a/t/t7510-signed-commit.sh\n+++ b/t/t7510-signed-commit.sh\n@@ -142,8 +142,7 @@ test_expect_success GPG 'show signed commit with signature' '\n \n test_expect_success GPG 'detect fudged signature' '\n \tgit cat-file commit seventh-signed >raw &&\n-\n-\tsed -e \"s/seventh/7th forged/\" raw >forged1 &&\n+\tsed -e \"s/^seventh/7th forged/\" raw >forged1 &&\n \tgit hash-object -w -t commit forged1 >forged1.commit &&\n \ttest_must_fail git verify-commit $(cat forged1.commit) &&\n \tgit show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&\ndiff --git a/t/t7612-merge-verify-signatures.sh b/t/t7612-merge-verify-signatures.sh\nindex e797c74112..e2b1df817a 100755\n--- a/t/t7612-merge-verify-signatures.sh\n+++ b/t/t7612-merge-verify-signatures.sh\n@@ -23,7 +23,7 @@ test_expect_success GPG 'create signed commits' '\n \techo 3 >bar && git add bar &&\n \ttest_tick && git commit -S -m \"bad on side\" &&\n \tgit cat-file commit side-bad >raw &&\n-\tsed -e \"s/bad/forged bad/\" raw >forged &&\n+\tsed -e \"s/^bad/forged bad/\" raw >forged &&\n \tgit hash-object -w -t commit forged >forged.commit &&\n \tgit checkout initial &&\n \n-- \n2.18.0.rc0.207.ga6211da864\n\n"},{"id":"349302","messageId":"20180604223335.GC288937@genre.crustytoothpaste.net","threadId":"48644","inReplyTo":"20180604133926.16558-2-szeder.dev@gmail.com","subject":"Re: [PATCH 2/2] tests: make forging GPG signed commits and tags more robust","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2018-06-04T22:33:36Z","receivedAt":"2018-06-04T22:33:45Z","isPatch":true,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Mon, Jun 04, 2018 at 03:39:26PM +0200, SZEDER Gábor wrote:\n> On rare occasions the given pattern occurs not only in the commit\n> message but in the GPG signature as well, and after it's replaced in\n> the signature the resulting signature becomes invalid, GPG will report\n> CRC error and that it couldn't find any signature, which will then\n> ultimately cause the test failure.\n\nOoh, I hadn't seen these failures, but thanks for tracking this down.\n\n> Since in all three cases the pattern to be replaced during the forgery\n> is the first word of the commit message's subject line, and since the\n> GPG signature in the commit object is indented by a space, let's just\n> anchor those patterns to the beginning of the line to prevent this\n> issue.\n> \n> The test script 't7030-verify-tag.sh' creates a forged signed tag\n> object in a similar way by replacing the pattern \"seventh\", but the\n> GPG signature in tag objects is not indented by a space, so the above\n> solution is not applicable in this case.  However, in the tag object\n> in question the pattern \"seventh\" occurs not only in the tag message\n> but in the 'tag' header as well.  To create a forged tag object it's\n> sufficient to replace only one of the two occurences, so modify the\n> sed script to limit the pattern to the 'tag' header (i.e. a line\n> beginning with \"tag \", which, because of the space character, can\n> never occur in the base64-encoded GPG signature).\n> \n> Note that the forgery in 't7004-tag.sh' is not affected by this issue:\n> while 't7004' does create a forged signed tag kind of the same way,\n> it replaces \"signed-tag\" in the tag object, which, because of the '-'\n> character, can never occur in the base64-encoded GPG signarute.\n\nThis seems sane and obviously correct, and the other patch looked good,\ntoo.  Thanks.\n-- \nbrian m. carlson: Houston, Texas, US\nOpenPGP: https://keybase.io/bk2204\n"}]}