{"thread":{"id":"49114","subject":"[PATCH] test verify-commit/tag to exit unsuccessfully","startedAt":"2018-08-13T15:20:11Z","lastAt":"2018-08-13T15:20:11Z","messageCount":1,"participants":["Vojtech Myslivec"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"355363","messageId":"b196ad40-544a-6909-abec-d87ccfd78aca@nic.cz","threadId":"49114","inReplyTo":null,"subject":"[PATCH] test verify-commit/tag to exit unsuccessfully","fromName":"Vojtech Myslivec","fromEmail":"vojtech.myslivec@nic.cz","sentAt":"2018-08-13T15:20:06Z","receivedAt":"2018-08-13T15:20:11Z","isPatch":true,"sender":{"key":"vojtech.myslivec@nic.cz","avatar":null},"body":"Hello\n\nThere was a discussion in the mailing list with subject\n'verify-tag/verify-commit should exit unsuccessfully when signature is\nnot trusted' which leads to handling exit code of untrusted signatures\nin 4e5dc9ca1.\n\ngit verify-commit and verify-tag should exit unsuccessfully when\nprocessing a signature by a gpg key with trust level set to 'never'.\n\nThis commit introduce verify checks with trust-model set to direct in\ngpg.conf (to force trust level of the second key in the keychain to\nnever). In these tests, 'git verify-tag/verify-commit eighth-signed-alt'\nmust exit unsuccessfully and includes 'We do NOT trust this key!' on the\nstderr (gpg output).\n\nFormatted patch is attached.\n\nVojtech Myslivec\n\n\nFrom 013678ac78ef42ef424a46da3b463ad96c2eb58d Mon Sep 17 00:00:00 2001\nFrom: Vojtech Myslivec <vojtech.myslivec@nic.cz>\nDate: Sat, 11 Aug 2018 22:59:49 +0200\nSubject: [PATCH] test verify-commit/tag to exit unsuccessfully\n\ngit verify-commit and verify-tag should exit unsuccessfully when\nprocessing a signature by a gpg key with trust level set to 'never'.\n\nThis commit introduce verify checks with trust-model set to direct in\ngpg.conf (to force trust level of the second key in the keychain to\nnever). In these tests, 'git verify-tag/verify-commit eighth-signed-alt'\nmust exit unsuccessfully and includes 'We do NOT trust this key!' on the\nstderr (gpg output).\n\nHelped-by: Karel Koci <karel.koci@nic.cz>\n---\n t/t7030-verify-tag.sh    | 34 ++++++++++++++++++++++++++++++++++\n t/t7510-signed-commit.sh | 36 ++++++++++++++++++++++++++++++++++++\n 2 files changed, 70 insertions(+)\n\ndiff --git a/t/t7030-verify-tag.sh b/t/t7030-verify-tag.sh\nindex 041e319e7..6bde65c9e 100755\n--- a/t/t7030-verify-tag.sh\n+++ b/t/t7030-verify-tag.sh\n@@ -172,4 +172,38 @@ test_expect_success GPG 'verifying a forged tag with --format should fail silent\n \ttest_must_be_empty actual-forged\n '\n \n+test_expect_success GPG 'verify signatures with direct trust-model' '\n+\t(\n+\t\techo \"trust-model:0:\\\"direct\" | gpgconf --change-options gpg\n+\t) &&\n+\t(\n+\t\tfor tag in initial second merge fourth-signed sixth-signed seventh-signed\n+\t\tdo\n+\t\t\tgit verify-tag $tag 2>actual &&\n+\t\t\tgrep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\techo $tag OK || exit 1\n+\t\tdone\n+\t) &&\n+\t(\n+\t\tfor tag in fourth-unsigned fifth-unsigned sixth-unsigned\n+\t\tdo\n+\t\t\ttest_must_fail git verify-tag $tag 2>actual &&\n+\t\t\t! grep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\techo $tag OK || exit 1\n+\t\tdone\n+\t) &&\n+\t(\n+\t\tfor tag in eighth-signed-alt\n+\t\tdo\n+\t\t\ttest_must_fail git verify-tag $tag 2>actual &&\n+\t\t\tgrep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\tgrep \"do NOT trust\" actual &&\n+\t\t\techo $tag OK || exit 1\n+\t\tdone\n+\t)\n+'\n+\n test_done\ndiff --git a/t/t7510-signed-commit.sh b/t/t7510-signed-commit.sh\nindex 4e37ff8f1..6e34f98a6 100755\n--- a/t/t7510-signed-commit.sh\n+++ b/t/t7510-signed-commit.sh\n@@ -234,4 +234,40 @@ test_expect_success GPG 'check config gpg.format values' '\n \ttest_must_fail git commit -S --amend -m \"fail\"\n '\n \n+test_expect_success GPG 'verify signatures with direct trust-model' '\n+\t(\n+\t\techo \"trust-model:0:\\\"direct\" | gpgconf --change-options gpg\n+\t) &&\n+\t(\n+\t\tfor commit in initial second merge fourth-signed \\\n+\t\t\tfifth-signed sixth-signed seventh-signed tenth-signed\n+\t\tdo\n+\t\t\tgit verify-commit $commit 2>actual &&\n+\t\t\tgrep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\techo $commit OK || exit 1\n+\t\tdone\n+\t) &&\n+\t(\n+\t\tfor commit in merge^2 fourth-unsigned sixth-unsigned \\\n+\t\t\tseventh-unsigned ninth-unsigned\n+\t\tdo\n+\t\t\ttest_must_fail git verify-commit $commit 2>actual &&\n+\t\t\t! grep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\techo $commit OK || exit 1\n+\t\tdone\n+\t) &&\n+\t(\n+\t\tfor commit in eighth-signed-alt\n+\t\tdo\n+\t\t\ttest_must_fail git verify-commit $commit 2>actual &&\n+\t\t\tgrep \"Good signature from\" actual &&\n+\t\t\t! grep \"BAD signature from\" actual &&\n+\t\t\tgrep \"do NOT trust\" actual &&\n+\t\t\techo $commit OK || exit 1\n+\t\tdone\n+\t)\n+'\n+\n test_done\n-- \n2.18.0\n\n"}]}