[PATCH v2] ssh signing: return an error when signature cannot be read

From: Phillip Wood <phillip.wood@dunelm.org.uk>

If the signature file cannot be read we print an error message but do not return an error to the caller. In practice it seems unlikely that the file would be unreadable if the call to ssh-keygen succeeds.

The unlink_or_warn() call is moved to the end of the function so that we always try and remove the signature file. This isn't strictly necessary at the moment but it protects us against any extra code being added between trying to read the signature file and the cleanup at the end of the function in the future. unlink_or_warn() only prints a warning if it exists and cannot be removed.

Signed-off-by: Phillip Wood <phillip.wood@dunelm.org.uk>
---
    ssh signing: return an error when signature cannot be read
    
    Thanks to Junio for his comments. I've updated the patch to always use
    unlink_or_warn() to remove the signature file as it does not warn on
    missing files.
    
    V1 cover letter
    
    This patch is based on maint. In the longer term the code could be
    simplified by using pipes rather than tempfiles as we do for gpg.
    ssh-keygen has supported reading the data to be signed from stdin and
    writing the signature to stdout since it introduced signing.

Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1371%2Fphillipwood%2Fssh-signing-return-error-on-missing-signature-v2
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1371/phillipwood/ssh-signing-return-error-on-missing-signature-v2
Pull-Request: https://github.com/gitgitgadget/git/pull/1371

Range-diff vs v1:

 1:  6f569ac0f48 ! 1:  1db8af68fce ssh signing: return an error when signature cannot be read
     @@ Commit message
      
          If the signature file cannot be read we print an error message but do
          not return an error to the caller. In practice it seems unlikely that
     -    the file would be unreadable if the call to ssh-keygen succeeds. If we
     -    cannot read the file it may be missing so ignore any errors from
     -    unlink() when we try to remove it.
     +    the file would be unreadable if the call to ssh-keygen succeeds.
     +
     +    The unlink_or_warn() call is moved to the end of the function so that
     +    we always try and remove the signature file. This isn't strictly
     +    necessary at the moment but it protects us against any extra code
     +    being added between trying to read the signature file and the cleanup
     +    at the end of the function in the future. unlink_or_warn() only prints
     +    a warning if it exists and cannot be removed.
      
          Signed-off-by: Phillip Wood <phillip.wood@dunelm.org.uk>
      
     @@ gpg-interface.c: static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf
      +		ret = error_errno(
       			_("failed reading ssh signing data buffer from '%s'"),
       			ssh_signature_filename.buf);
     -+		unlink(ssh_signature_filename.buf);
      +		goto out;
       	}
     - 	unlink_or_warn(ssh_signature_filename.buf);
     +-	unlink_or_warn(ssh_signature_filename.buf);
     +-
     + 	/* Strip CR from the line endings, in case we are on Windows. */
     + 	remove_cr_after(signature, bottom);
       
     +@@ gpg-interface.c: out:
     + 		delete_tempfile(&key_file);
     + 	if (buffer_file)
     + 		delete_tempfile(&buffer_file);
     ++	if (ssh_signature_filename.len)
     ++		unlink_or_warn(ssh_signature_filename.buf);
     + 	strbuf_release(&signer_stderr);
     + 	strbuf_release(&ssh_signature_filename);
     + 	FREE_AND_NULL(ssh_signing_key_file);

 gpg-interface.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)