a06673b
//! signature usecase: signature verification.
use gix::hash::ObjectId;
use crate::GitRepository;
use crate::signature::impls::SignatureOps;
use crate::signature::types::{SignatureInfo, VerifyResult};
fn extract_signature(
extra_headers: &[(gix::bstr::BString, gix::bstr::BString)],
) -> Option<&gix::bstr::BString> {
for (k, v) in extra_headers {
if k.eq_ignore_ascii_case(b"gpgsig") {
return Some(v);
}
}
None
}
/// Verify a PGP signature over the given signed data using the system `gpg`.
///
/// Returns `Ok(true)` if the signature is valid, `Ok(false)` if invalid/unsigned.
/// Returns `Err` if gpg is unavailable (fail-closed so callers can decide).
fn verify_pgp(signature: &[u8], signed_data: &[u8]) -> Result<bool, crate::Error> {
use std::io::Write;
use std::process::{Command, Stdio};
let mut child = Command::new("gpg")
.arg("--batch")
.arg("--verify")
.stdin(Stdio::piped())
.stdout(Stdio::piped())
.stderr(Stdio::piped())
.spawn()
.map_err(|e| crate::Error::Other(format!("gpg unavailable: {e}")))?;
let mut stdin = child
.stdin
.take()
.ok_or_else(|| crate::Error::Other("gpg stdin unavailable".to_string()))?;
// Write signature then signed data to gpg's stdin.
stdin
.write_all(signature)
.map_err(|e| crate::Error::Io(e.to_string()))?;
stdin
.write_all(b"\n")
.map_err(|e| crate::Error::Io(e.to_string()))?;
stdin
.write_all(signed_data)
.map_err(|e| crate::Error::Io(e.to_string()))?;
drop(stdin);
let output = child
.wait_with_output()
.map_err(|e| crate::Error::Io(e.to_string()))?;
Ok(output.status.success())
}
impl SignatureOps for GitRepository {
fn signature_verify_commit(&self, id: &ObjectId) -> Result<VerifyResult, crate::Error> {
let repo = self.repo()?;
// Get the raw commit bytes so we can extract the PGP signature and
// the exact signed data.
let raw = repo
.find_object(*id)
.map_err(|e| crate::Error::Find(e.to_string()))?
.data
.to_vec();
let (sig, signed_data) =
match gix::diff::object::CommitRefIter::signature(&raw, repo.object_hash()) {
Ok(Some((sig, signed_data))) => (sig, signed_data),
Ok(None) | Err(_) => {
return Ok(VerifyResult {
signed: false,
valid: false,
key_id: None,
signer: None,
});
}
};
let valid = verify_pgp(sig.as_ref(), &signed_data.to_bstring())?;
let commit = repo
.find_commit(*id)
.map_err(|e| crate::Error::Find(e.to_string()))?;
let decoded = commit
.decode()
.map_err(|e| crate::Error::Find(e.to_string()))?
.into_owned()
.map_err(|e| crate::Error::Find(e.to_string()))?;
let info = extract_signature(&decoded.extra_headers).map(|s| SignatureInfo {
signature: s.to_string(),
payload: decoded.message.to_string(),
key_id: None,
signer: None,
});
Ok(VerifyResult {
signed: info.is_some(),
valid,
key_id: None,
signer: None,
})
}
fn signature_verify_tag(&self, id: &ObjectId) -> Result<VerifyResult, crate::Error> {
let repo = self.repo()?;
let tag = repo
.find_tag(*id)
.map_err(|e| crate::Error::Find(e.to_string()))?;
let tag_ref = tag
.decode()
.map_err(|e| crate::Error::Find(e.to_string()))?;
let Some(sig) = tag_ref.pgp_signature else {
return Ok(VerifyResult {
signed: false,
valid: false,
key_id: None,
signer: None,
});
};
// Reconstruct the signed tag payload (gix does not expose it directly,
// so verify the signature over the raw tag object bytes).
let mut buf = Vec::new();
use gix::objs::WriteTo;
tag_ref
.write_to(&mut buf)
.map_err(|e| crate::Error::Odb(e.to_string()))?;
let valid = verify_pgp(sig.as_ref(), &buf)?;
Ok(VerifyResult {
signed: true,
valid,
key_id: None,
signer: None,
})
}
fn signature_commit_signature(
&self,
id: &ObjectId,
) -> Result<Option<SignatureInfo>, crate::Error> {
if let Some(hit) = self.cache_get_oid::<Option<SignatureInfo>>("sig_commit_meta", id) {
return Ok(hit);
}
let repo = self.repo()?;
let commit = repo
.find_commit(*id)
.map_err(|e| crate::Error::Find(e.to_string()))?;
let decoded = commit
.decode()
.map_err(|e| crate::Error::Find(e.to_string()))?
.into_owned()
.map_err(|e| crate::Error::Find(e.to_string()))?;
let v = extract_signature(&decoded.extra_headers).map(|s| SignatureInfo {
signature: s.to_string(),
payload: decoded.message.to_string(),
key_id: None,
signer: None,
});
self.cache_put_oid("sig_commit_meta", id, &v);
Ok(v)
}
fn signature_tag_signature(
&self,
id: &ObjectId,
) -> Result<Option<SignatureInfo>, crate::Error> {
if let Some(hit) = self.cache_get_oid::<Option<SignatureInfo>>("sig_tag_meta", id) {
return Ok(hit);
}
let repo = self.repo()?;
let tag = repo
.find_tag(*id)
.map_err(|e| crate::Error::Find(e.to_string()))?;
let tag_ref = tag
.decode()
.map_err(|e| crate::Error::Find(e.to_string()))?;
let v = tag_ref.pgp_signature.map(|s| SignatureInfo {
signature: s.to_string(),
payload: tag_ref.message.to_string(),
key_id: None,
signer: None,
});
self.cache_put_oid("sig_tag_meta", id, &v);
Ok(v)
}
}