path: root/t/
diff options
authorHans Jerry Illikainen <>2019-11-22 20:23:12 (GMT)
committerJunio C Hamano <>2019-11-23 00:18:40 (GMT)
commit67a6ea63008bcee32a239934ad29eb5c5a554509 (patch)
treeced58695d6c423f4ae0db505d095dbd3463fe592 /t/
parent392b862e9aea69acf43532527e27644c97e3ea56 (diff)
gpg-interface: limit search for primary key fingerprint
The VALIDSIG status line from GnuPG with --status-fd is documented to have 9 required and 1 optional fields [1]. The final, and optional, field is used to specify the fingerprint of the primary key that made the signature in case it was made by a subkey. However, this field is only available for OpenPGP signatures; not for CMS/X.509. If the VALIDSIG status line does not have the optional 10th field, the current code will continue reading onto the next status line. And this is the case for non-OpenPGP signatures [1]. The consequence is that a subsequent status line may be considered as the "primary key" for signatures that does not have an actual primary key. Limit the search of these 9 or 10 fields to the single line to avoid this problem. If the 10th field is missing, report that there is no primary key fingerprint. [Reference] [1] GnuPG Details, General status codes;a=blob;f=doc/DETAILS;h=6ce340e8c04794add995e84308bb3091450bd28f;hb=HEAD#l483 The documentation says: VALIDSIG <args> The args are: - <fingerprint_in_hex> - <sig_creation_date> - <sig-timestamp> - <expire-timestamp> - <sig-version> - <reserved> - <pubkey-algo> - <hash-algo> - <sig-class> - [ <primary-key-fpr> ] This status indicates that the signature is cryptographically valid. [...] PRIMARY-KEY-FPR is the fingerprint of the primary key or identical to the first argument. The primary-key-fpr parameter is used for OpenPGP and not available for CMS signatures. [...] Signed-off-by: Hans Jerry Illikainen <> Signed-off-by: Junio C Hamano <>
Diffstat (limited to 't/')
1 files changed, 20 insertions, 0 deletions
diff --git a/t/ b/t/
index 819c24d..da8cb06 100755
--- a/t/
+++ b/t/
@@ -1555,6 +1555,14 @@ test_expect_success GPG 'setup signed branch' '
git commit -S -m signed_commit
+test_expect_success GPG 'setup signed branch with subkey' '
+ test_when_finished "git reset --hard && git checkout master" &&
+ git checkout -b signed-subkey master &&
+ echo foo >foo &&
+ git add foo &&
+ git commit -SB7227189 -m signed_commit
test_expect_success GPGSM 'setup signed branch x509' '
test_when_finished "git reset --hard && git checkout master" &&
git checkout -b signed-x509 master &&
@@ -1565,6 +1573,18 @@ test_expect_success GPGSM 'setup signed branch x509' '
git commit -S -m signed_commit
+test_expect_success GPGSM 'log x509 fingerprint' '
+ echo "F8BF62E0693D0694816377099909C779FA23FD65 | " >expect &&
+ git log -n1 --format="%GF | %GP" signed-x509 >actual &&
+ test_cmp expect actual
+test_expect_success GPGSM 'log OpenPGP fingerprint' '
+ echo "D4BE22311AD3131E5EDA29A461092E85B7227189" > expect &&
+ git log -n1 --format="%GP" signed-subkey >actual &&
+ test_cmp expect actual
test_expect_success GPG 'log --graph --show-signature' '
git log --graph --show-signature -n1 signed >actual &&
grep "^| gpg: Signature made" actual &&