Merge lp:~jelmer/brz-git/gpg-signatures into lp:brz-git

[Jelmer Vernooij]

Add support for signing commits.

This depends on lp:~jelmer/brz/gpg-detached-sign

[lp:~jelmer/brz-git/gpg-signatures]

1845. By Jelmer Vernooij on 2018-03-11

Support verifying signatures.

1846. By Jelmer Vernooij on 2018-03-11

use new API.

[Jelmer Vernooij (jelmer)]

review: Approve

[lp:~jelmer/brz-git/gpg-signatures]

1847. By Jelmer Vernooij on 2018-03-17

Merge trunk.

1848. By Jelmer Vernooij on 2018-03-17

Merge lp:~jelmer/brz-git/gpg-signatures.

=== modified file 'commit.py'
--- commit.py	2018-03-17 19:20:55 +0000
+++ commit.py	2018-03-17 23:04:35 +0000
@@ -29,6 +29,8 @@
     entry_factory,
     )
 from ... import (
+    config as _mod_config,
+    gpg,
     osutils,
     revision as _mod_revision,
     )
@@ -229,6 +231,9 @@
         c.commit_timezone = self._timezone
         c.author_timezone = self._timezone
         c.message = message.encode(c.encoding)
+        if self._config_stack.get('create_signatures') == _mod_config.SIGN_ALWAYS:
+            strategy = gpg.GPGStrategy(self._config_stack)
+            c.gpgsig = strategy.sign(c.as_raw_string(), gpg.MODE_DETACH)
         self.store.add_object(c)
         self.repository.commit_write_group()
         self._new_revision_id = self._mapping.revision_id_foreign_to_bzr(c.id)

=== modified file 'repository.py'
--- repository.py	2018-03-17 19:20:55 +0000
+++ repository.py	2018-03-17 23:04:35 +0000
@@ -408,7 +408,14 @@
         return _mod_graph.KnownGraph(parent_map)
 
     def get_signature_text(self, revision_id):
-        raise errors.NoSuchRevision(self, revision_id)
+        git_commit_id, mapping = self.lookup_bzr_revision_id(revision_id)
+        try:
+            commit = self._git.object_store[git_commit_id]
+        except KeyError:
+            raise errors.NoSuchRevision(self, revision_id)
+        if commit.gpgsig is None:
+            raise errors.NoSuchRevision(self, revision_id)
+        return commit.gpgsig
 
     def check(self, revision_ids=None, callback_refs=None, check_repo=True):
         result = GitCheck(self, check_repo=check_repo)
@@ -448,7 +455,37 @@
 
         This is never the case for Git repositories.
         """
-        return False
+        try:
+            self.get_signature_text(revision_id)
+        except errors.NoSuchRevision:
+            return False
+        else:
+            return True
+
+    def verify_revision_signature(self, revision_id, gpg_strategy):
+        """Verify the signature on a revision.
+
+        :param revision_id: the revision to verify
+        :gpg_strategy: the GPGStrategy object to used
+
+        :return: gpg.SIGNATURE_VALID or a failed SIGNATURE_ value
+        """
+        from breezy import gpg
+        with self.lock_read():
+            git_commit_id, mapping = self.lookup_bzr_revision_id(revision_id)
+            try:
+                commit = self._git.object_store[git_commit_id]
+            except KeyError:
+                raise errors.NoSuchRevision(self, revision_id)
+
+            if commit.gpgsig is None:
+                return gpg.SIGNATURE_NOT_SIGNED, None
+
+            without_sig = Commit.from_string(commit.as_raw_string())
+            without_sig.gpgsig = None
+
+            (result, key, plain_text) = gpg_strategy.verify(without_sig.as_raw_string(), commit.gpgsig)
+            return (result, key)
 
     def lookup_bzr_revision_id(self, bzr_revid, mapping=None):
         """Lookup a bzr revision id in a Git repository.

=== modified file 'tests/test_repository.py'
--- tests/test_repository.py	2018-03-17 17:34:12 +0000
+++ tests/test_repository.py	2018-03-17 23:04:35 +0000
@@ -26,6 +26,7 @@
 import os
 
 from .... import (
+    config,
     errors,
     revision,
     )
@@ -192,6 +193,28 @@
                            self.git_repo.get_parent_map([revision.NULL_REVISION]))
 
 
+class SigningGitRepository(tests.TestCaseWithTransport):
+
+    def test_signed_commit(self):
+        import breezy.gpg
+        oldstrategy = breezy.gpg.GPGStrategy
+        wt = self.make_branch_and_tree('.', format='git')
+        branch = wt.branch
+        revid = wt.commit("base", allow_pointless=True)
+        self.assertFalse(branch.repository.has_signature_for_revision_id(revid))
+        try:
+            breezy.gpg.GPGStrategy = breezy.gpg.LoopbackGPGStrategy
+            conf = config.MemoryStack('''
+create_signatures=always
+''')
+            revid2 = wt.commit(config=conf, message="base", allow_pointless=True)
+            def sign(text):
+                return breezy.gpg.LoopbackGPGStrategy(None).sign(text)
+            self.assertIsInstance(branch.repository.get_signature_text(revid2), str)
+        finally:
+            breezy.gpg.GPGStrategy = oldstrategy
+
+
 class GitRepositoryFormat(tests.TestCase):
 
     def setUp(self):