path: root/t
diff options
authorMichał Górny <>2018-10-20 19:30:20 (GMT)
committerJunio C Hamano <>2018-10-22 03:42:30 (GMT)
commitda6cf1b3360eefdce3dbde7632eca57177327f37 (patch)
treea1105c58db7deb0adc220b7cb9f050a35fa05361 /t
parentcae598d9980661a978e2df4fb338518f7bf09572 (diff)
gpg-interface.c: detect and reject multiple signatures on commits
GnuPG supports creating signatures consisting of multiple signature packets. If such a signature is verified, it outputs all the status messages for each signature separately. However, git currently does not account for such scenario and gets terribly confused over getting multiple *SIG statuses. For example, if a malicious party alters a signed commit and appends a new untrusted signature, git is going to ignore the original bad signature and report untrusted commit instead. However, %GK and %GS format strings may still expand to the data corresponding to the original signature, potentially tricking the scripts into trusting the malicious commit. Given that the use of multiple signatures is quite rare, git does not support creating them without jumping through a few hoops, and finally supporting them properly would require extensive API improvement, it seems reasonable to just reject them at the moment. Signed-off-by: Michał Górny <> Signed-off-by: Junio C Hamano <>
Diffstat (limited to 't')
1 files changed, 26 insertions, 0 deletions
diff --git a/t/ b/t/
index 4e37ff8..180f0be 100755
--- a/t/
+++ b/t/
@@ -234,4 +234,30 @@ test_expect_success GPG 'check config gpg.format values' '
test_must_fail git commit -S --amend -m "fail"
+test_expect_success GPG 'detect fudged commit with double signature' '
+ sed -e "/gpgsig/,/END PGP/d" forged1 >double-base &&
+ sed -n -e "/gpgsig/,/END PGP/p" forged1 | \
+ sed -e "s/^gpgsig//;s/^ //" | gpg --dearmor >double-sig1.sig &&
+ gpg -o double-sig2.sig -u 29472784 --detach-sign double-base &&
+ cat double-sig1.sig double-sig2.sig | gpg --enarmor >double-combined.asc &&
+ sed -e "s/^\(-.*\)ARMORED FILE/\1SIGNATURE/;1s/^/gpgsig /;2,\$s/^/ /" \
+ double-combined.asc > double-gpgsig &&
+ sed -e "/committer/r double-gpgsig" double-base >double-commit &&
+ git hash-object -w -t commit double-commit >double-commit.commit &&
+ test_must_fail git verify-commit $(cat double-commit.commit) &&
+ git show --pretty=short --show-signature $(cat double-commit.commit) >double-actual &&
+ grep "BAD signature from" double-actual &&
+ grep "Good signature from" double-actual
+test_expect_success GPG 'show double signature with custom format' '
+ cat >expect <<-\EOF &&
+ E
+ git log -1 --format="%G?%n%GK%n%GS" $(cat double-commit.commit) >actual &&
+ test_cmp expect actual