- * Implementors should obtain the payload for signing from the specified - * commit via {@link CommitBuilder#build()} and create a proper - * {@link GpgSignature}. The generated signature must be set on the - * specified {@code commit} (see - * {@link CommitBuilder#setGpgSignature(GpgSignature)}). - *
- *- * Any existing signature on the commit must be discarded prior obtaining - * the payload via {@link CommitBuilder#build()}. - *
- * - * @param commit - * the commit to sign (must not benull and must be
- * complete to allow proper calculation of payload)
- * @param gpgSigningKey
- * the signing key to locate (passed as is to the GPG signing
- * tool as is; eg., value of user.signingkey)
- * @param committer
- * the signing identity (to help with key lookup in case signing
- * key is not specified)
- * @param credentialsProvider
- * provider to use when querying for signing key credentials (eg.
- * passphrase)
- * @throws CanceledException
- * when signing was canceled (eg., user aborted when entering
- * passphrase)
- */
- @Override
- public void sign(final CommitBuilder commit, final String gpgSigningKey, final PersonIdent committer,
- final CredentialsProvider credentialsProvider) throws CanceledException {
- signObject(commit, gpgSigningKey, committer, credentialsProvider);
- }
-
- private void signObject(final ObjectBuilder object, final String gpgSigningKey,
- final PersonIdent committer, final CredentialsProvider credentialsProvider)
- throws CanceledException {
- // Ignore the CredentialsProvider. We let GPG handle all this.
- try {
- String keySpec = gpgSigningKey;
- if (StringUtils.isEmptyOrNull(keySpec)) {
- // fallback
- if (committer == null) {
- throw new CanceledException("Cannot determine signature key");
- }
- keySpec = '<' + committer.getEmailAddress() + '>';
- }
- // git config gpg.program
- // Use this custom program instead of "gpg" found on $PATH when
- // making or verifying a PGP signature.
- GpgConfig config = new GpgConfig(new Config());
- object.setGpgSignature(new GpgSignature(signWithGpg(config, object.build(), keySpec)));
- } catch (IOException e) {
- throw new JGitInternalException(e.getMessage(), e);
- }
- }
-
- /**
- * Indicates if a signing key is available for the specified committer
- * and/or signing key.
- *
- * @param gpgSigningKey
- * the signing key to locate (passed as is to the GPG signing
- * tool as is; e.g., value of user.signingkey)
- * @param committer
- * the signing identity (to help with key lookup in case signing
- * key is not specified)
- * @param credentialsProvider
- * provider to use when querying for signing key credentials (eg.
- * passphrase)
- * @return true if a signing key is available,
- * false otherwise
- * @throws CanceledException
- * when signing was canceled (eg., user aborted when entering
- * passphrase)
- */
- @Override
- public boolean canLocateSigningKey(final String gpgSigningKey, final PersonIdent committer,
- final CredentialsProvider credentialsProvider) throws CanceledException {
- // Ignore the CredentialsProvider. We let GPG handle all this.
- String program = FROM_PATH.getGpg();
- if (StringUtils.isEmptyOrNull(program)) {
- return false;
- }
- String keySpec = gpgSigningKey;
- if (StringUtils.isEmptyOrNull(keySpec)) {
- keySpec = '<' + committer.getEmailAddress() + '>';
- }
- ProcessBuilder process = new ProcessBuilder();
- // For the output format, see
- // https://github.com/gpg/gnupg/blob/master/doc/DETAILS
- process.command(program, "--locate-keys", //$NON-NLS-1$
- "--with-colons", //$NON-NLS-1$
- "--batch", //$NON-NLS-1$
- "--no-tty", //$NON-NLS-1$
- keySpec);
- gpgEnvironment(process);
- try {
- boolean[] result = { false };
- runProcess(process, null, b -> {
- try (BufferedReader r = new BufferedReader(
- new InputStreamReader(b.openInputStream(), StandardCharsets.UTF_8))) {
- // --with-colons always writes UTF-8
- boolean keyFound = false;
- String line;
- while ((line = r.readLine()) != null) {
- if (line.startsWith("pub:") //$NON-NLS-1$
- || line.startsWith("sub:")) { //$NON-NLS-1$
- String[] fields = line.split(":"); //$NON-NLS-1$
- if (fields.length > 11 && fields[11].indexOf('s') >= 0) {
- // It's a signing key.
- keyFound = true;
- break;
- }
- }
- }
- result[0] = keyFound;
- }
- }, null);
- if (!result[0]) {
- if (!StringUtils.isEmptyOrNull(gpgSigningKey)) {
- LOGGER.atWarn().setMessageRB(ExternalGpgSigner_noKeyFound).addArgument(gpgSigningKey)
- .log();
- }
- }
- return result[0];
- } catch (IOException e) {
- Log.log(e);
- return false;
- }
- }
-
- private byte[] signWithGpg(GpgConfig config, byte[] data, String keySpec)
- throws IOException, CanceledException {
- // Sign an object with an external GPG executable. GPG handles
- // passphrase entry, including gpg-agent and native keychain
- // integration.
- String program = config.getProgram();
- if (StringUtils.isEmptyOrNull(program)) {
- program = FROM_PATH.getGpg();
- if (StringUtils.isEmptyOrNull(program)) {
- throw new IOException(OStrings.getString(ExternalGpgSigner_gpgNotFound));
- }
- }
- ProcessBuilder process = new ProcessBuilder();
- process.command(program,
- // Detached signature, sign, armor, user
- "-bsau", //$NON-NLS-1$
- keySpec,
- // No extra output
- "--batch", //$NON-NLS-1$
- "--no-tty", //$NON-NLS-1$
- // Write extra status messages to stderr
- "--status-fd", //$NON-NLS-1$
- "2", //$NON-NLS-1$
- // Force output of the signature to stdout
- "--output", //$NON-NLS-1$
- "-"); //$NON-NLS-1$
- gpgEnvironment(process);
- try (ByteArrayInputStream dataIn = new ByteArrayInputStream(data)) {
- class Holder {
- byte[] rawData;
- }
- Holder result = new Holder();
- runProcess(process, dataIn, (TemporaryBuffer b) -> {
- // Sanity check: do we have a signature?
- GpgSignatureVerifierFactory factory = GpgSignatureVerifierFactory.getDefault();
- boolean isValid;
- if (factory == null) {
- byte[] fromGpg = b.toByteArray(SIGNATURE_START.length);
- isValid = Arrays.equals(fromGpg, SIGNATURE_START);
- if (isValid) {
- result.rawData = b.toByteArray();
- }
- } else {
- byte[] fromGpg = b.toByteArray();
- GpgSignatureVerifier verifier = factory.getVerifier();
- try {
- SignatureVerification verification = verifier.verify(config, data, fromGpg);
- isValid = verification != null && verification.getVerified();
- if (isValid) {
- result.rawData = fromGpg;
- }
- } catch (JGitInternalException e) {
- throw new IOException(e.getLocalizedMessage(), e);
- } finally {
- verifier.clear();
- }
- }
- if (!isValid) {
- throw new IOException(OStrings.getString(ExternalGpgSigner_noSignature, toString(b)));
- }
- }, (TemporaryBuffer e) -> {
- // Error handling: parse stderr to figure out whether we have a
- // cancellation. Unfortunately, GPG does record cancellation not
- // via a [GNUPG:] stable status but by printing "gpg: signing
- // failed: Operation cancelled". Since we don't know whether
- // this string is stable (or may even be localized), we check
- // for a "[GNUPG:] PINENTRY_LAUNCHED" line followed by the next
- // [GNUPG:] line being "[GNUPG:] FAILURE sign".
- //
- // The [GNUPG:] strings are part of GPG's public API. See
- // https://github.com/gpg/gnupg/blob/master/doc/DETAILS
- try (BufferedReader r = new BufferedReader(
- new InputStreamReader(e.openInputStream(), StandardCharsets.UTF_8))) {
- String line;
- boolean pinentry = false;
- while ((line = r.readLine()) != null) {
- if (!pinentry && line.startsWith("[GNUPG:] PINENTRY_LAUNCHED")) {
- pinentry = true;
- } else if (pinentry) {
- if (line.startsWith("[GNUPG:] FAILURE sign")) {
- throw new CanceledException(
- OStrings.getString(ExternalGpgSigner_signingCanceled));
- }
- if (line.startsWith("[GNUPG:]")) {
- pinentry = false;
- }
- }
- }
- } catch (IOException ex) {
- // Swallow it here; runProcess will raise one anyway.
- }
- });
- return result.rawData;
- }
- }
-
- private void gpgEnvironment(ProcessBuilder process) {
- try {
- Map