debian-mirror-gitlab/lib/gitlab/gpg/commit.rb

118 lines
3.4 KiB
Ruby
Raw Normal View History

2019-02-15 15:39:39 +05:30
# frozen_string_literal: true
2017-09-10 17:25:29 +05:30
module Gitlab
module Gpg
2020-03-13 15:44:24 +05:30
class Commit < Gitlab::SignedCommit
2017-09-10 17:25:29 +05:30
def update_signature!(cached_signature)
using_keychain do |gpg_key|
2018-11-18 11:00:15 +05:30
cached_signature.update!(attributes(gpg_key))
2019-02-15 15:39:39 +05:30
@signature = cached_signature
2017-09-10 17:25:29 +05:30
end
end
private
2022-08-13 15:12:31 +05:30
def signature_class
CommitSignatures::GpgSignature
2019-12-21 20:55:43 +05:30
end
2017-09-10 17:25:29 +05:30
def using_keychain
Gitlab::Gpg.using_tmp_keychain do
2019-09-04 21:01:54 +05:30
# first we need to get the fingerprint from the signature to query the gpg
# key belonging to the fingerprint.
2017-09-10 17:25:29 +05:30
# This way we can add the key to the temporary keychain and extract
# the proper signature.
2019-09-04 21:01:54 +05:30
# NOTE: the invoked method is #fingerprint but versions of GnuPG
# prior to 2.2.13 return 16 characters (the format used by keyid)
# instead of 40.
2019-02-15 15:39:39 +05:30
fingerprint = verified_signature&.fingerprint
break unless fingerprint
gpg_key = find_gpg_key(fingerprint)
2017-09-10 17:25:29 +05:30
if gpg_key
Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
2021-12-11 22:18:48 +05:30
clear_memoization(:gpg_signatures)
2017-09-10 17:25:29 +05:30
end
yield gpg_key
end
end
def verified_signature
2021-12-11 22:18:48 +05:30
gpg_signatures.first
2017-09-10 17:25:29 +05:30
end
def create_cached_signature!
using_keychain do |gpg_key|
2019-03-02 22:35:43 +05:30
attributes = attributes(gpg_key)
2022-01-26 12:08:38 +05:30
break CommitSignatures::GpgSignature.new(attributes) if Gitlab::Database.read_only?
2019-03-02 22:35:43 +05:30
2022-01-26 12:08:38 +05:30
CommitSignatures::GpgSignature.safe_create!(attributes)
2017-09-10 17:25:29 +05:30
end
end
2021-12-11 22:18:48 +05:30
def gpg_signatures
strong_memoize(:gpg_signatures) do
signatures = []
GPGME::Crypto.new.verify(signature_text, signed_text: signed_text) do |verified_signature|
signatures << verified_signature
end
signatures
rescue GPGME::Error
[]
end
end
def multiple_signatures?
gpg_signatures.size > 1
end
2017-09-10 17:25:29 +05:30
def attributes(gpg_key)
user_infos = user_infos(gpg_key)
2018-03-17 18:26:18 +05:30
verification_status = verification_status(gpg_key)
2017-09-10 17:25:29 +05:30
{
2018-03-17 18:26:18 +05:30
commit_sha: @commit.sha,
project: @commit.project,
2017-09-10 17:25:29 +05:30
gpg_key: gpg_key,
2019-02-15 15:39:39 +05:30
gpg_key_primary_keyid: gpg_key&.keyid || verified_signature&.fingerprint,
2017-09-10 17:25:29 +05:30
gpg_key_user_name: user_infos[:name],
gpg_key_user_email: user_infos[:email],
2018-03-17 18:26:18 +05:30
verification_status: verification_status
2017-09-10 17:25:29 +05:30
}
end
2018-03-17 18:26:18 +05:30
def verification_status(gpg_key)
2022-03-02 08:16:31 +05:30
return :multiple_signatures if multiple_signatures?
2018-03-17 18:26:18 +05:30
return :unknown_key unless gpg_key
return :unverified_key unless gpg_key.verified?
2019-02-15 15:39:39 +05:30
return :unverified unless verified_signature&.valid?
2018-03-17 18:26:18 +05:30
if gpg_key.verified_and_belongs_to_email?(@commit.committer_email)
:verified
elsif gpg_key.user.all_emails.include?(@commit.committer_email)
:same_user_different_email
else
:other_user
end
2017-09-10 17:25:29 +05:30
end
def user_infos(gpg_key)
gpg_key&.verified_user_infos&.first || gpg_key&.user_infos&.first || {}
end
2018-03-17 18:26:18 +05:30
2019-09-04 21:01:54 +05:30
def find_gpg_key(fingerprint)
if fingerprint.length > 16
GpgKey.find_by_fingerprint(fingerprint) || GpgKeySubkey.find_by_fingerprint(fingerprint)
else
GpgKey.find_by_primary_keyid(fingerprint) || GpgKeySubkey.find_by_keyid(fingerprint)
end
2018-03-17 18:26:18 +05:30
end
2017-09-10 17:25:29 +05:30
end
end
end