revisit gpg api and use it with from git plugin

This commit is contained in:
Sebastian Sdorra
2020-07-22 08:22:04 +02:00
parent 7cb349242c
commit 64da676348
18 changed files with 587 additions and 157 deletions

View File

@@ -38,9 +38,9 @@ import org.junit.rules.TemporaryFolder;
import org.junit.runner.RunWith;
import org.mockito.Mock;
import org.mockito.junit.MockitoJUnitRunner;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitConfig;
import sonia.scm.repository.GitRepositoryHandler;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.web.CollectingPackParserListener;
import sonia.scm.web.GitReceiveHook;
@@ -83,7 +83,7 @@ public class BaseReceivePackFactoryTest {
ReceivePack receivePack = new ReceivePack(repository);
when(wrappedReceivePackFactory.create(request, repository)).thenReturn(receivePack);
factory = new BaseReceivePackFactory<Object>(new GitChangesetConverterFactory(), handler, null) {
factory = new BaseReceivePackFactory<Object>(GitTestHelper.createConverterFactory(), handler, null) {
@Override
protected ReceivePack createBasicReceivePack(Object request, Repository repository) throws ServiceNotEnabledException, ServiceNotAuthorizedException {
return wrappedReceivePackFactory.create(request, repository);

View File

@@ -0,0 +1,303 @@
/*
* MIT License
*
* Copyright (c) 2020-present Cloudogu GmbH and Contributors
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.repository;
import org.bouncycastle.bcpg.ArmoredOutputStream;
import org.bouncycastle.bcpg.BCPGOutputStream;
import org.bouncycastle.bcpg.HashAlgorithmTags;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPKeyPair;
import org.bouncycastle.openpgp.PGPPrivateKey;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.PGPSignatureGenerator;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentSignerBuilder;
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyPair;
import org.eclipse.jgit.api.Git;
import org.eclipse.jgit.api.errors.GitAPIException;
import org.eclipse.jgit.api.errors.JGitInternalException;
import org.eclipse.jgit.internal.JGitText;
import org.eclipse.jgit.lib.CommitBuilder;
import org.eclipse.jgit.lib.GpgSignature;
import org.eclipse.jgit.lib.GpgSigner;
import org.eclipse.jgit.lib.PersonIdent;
import org.eclipse.jgit.revwalk.RevCommit;
import org.eclipse.jgit.revwalk.RevWalk;
import org.eclipse.jgit.transport.CredentialsProvider;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Nested;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
import org.junit.jupiter.api.io.TempDir;
import org.mockito.ArgumentCaptor;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoExtension;
import sonia.scm.security.GPG;
import sonia.scm.security.PublicKey;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
import java.util.Date;
import java.util.List;
import java.util.Optional;
import java.util.UUID;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
@ExtendWith(MockitoExtension.class)
class GitChangesetConverterTest {
private static Git git;
@BeforeAll
static void setUpRepository(@TempDir Path repositoryPath) throws GitAPIException {
// we use the same repository for all tests to speed things up
git = Git.init().setDirectory(repositoryPath.toFile()).call();
}
@AfterAll
static void closeRepository() {
git.close();
}
@Test
void shouldConvertChangeset() throws GitAPIException, IOException {
long now = System.currentTimeMillis() - 1000L;
Changeset changeset = commit(
"Tricia McMillan", "trillian@hitchhiker.com", "Added awesome markdown file"
);
assertThat(changeset.getId()).isNotEmpty();
assertThat(changeset.getDate()).isGreaterThanOrEqualTo(now);
assertThat(changeset.getDescription()).isEqualTo("Added awesome markdown file");
Person author = changeset.getAuthor();
assertThat(author.getName()).isEqualTo("Tricia McMillan");
assertThat(author.getMail()).isEqualTo("trillian@hitchhiker.com");
}
private Changeset commit(String name, String mail, String message) throws GitAPIException, IOException {
addRandomFileToRepository();
RevCommit commit = git.commit()
.setAuthor(name, mail)
.setMessage(message)
.call();
GitChangesetConverterFactory converterFactory = GitTestHelper.createConverterFactory();
return converterFactory.create(git.getRepository()).createChangeset(commit);
}
private void addRandomFileToRepository() throws IOException, GitAPIException {
File directory = git.getRepository().getWorkTree();
String name = UUID.randomUUID().toString();
File file = new File(directory, name + ".md");
Files.write(file.toPath(), ("# Greetings\n\nFrom " + name).getBytes(StandardCharsets.UTF_8));
git.add().addFilepattern(name + ".md").call();
}
@Nested
class SignatureTests {
@Mock
private GPG gpg;
@Mock
private PublicKey publicKey;
private PGPKeyPair keyPair;
private GpgSigner defaultSigner;
@BeforeEach
void setUpTestingSignerAndCaptureDefault() throws Exception {
defaultSigner = GpgSigner.getDefault();
// we use the same keypair for all tests to speed things up a little bit
if (keyPair == null) {
keyPair = createKeyPair();
GpgSigner.setDefault(new TestingGpgSigner(keyPair));
}
}
@AfterEach
void restoreDefaultSigner() {
GpgSigner.setDefault(defaultSigner);
}
@Test
void shouldReturnUnknownSignature() throws Exception {
String identity = "0xAWESOMExBOB";
when(gpg.findPublicKeyId(any())).thenReturn(identity);
Signature signature = addSignedCommitAndReturnSignature(identity);
assertThat(signature).isEqualTo(new Signature(identity, "gpg", false, null));
}
@Test
void shouldReturnKnownButInvalidSignature() throws Exception {
String identity = "0xAWESOMExBOB";
String owner = "BobTheSigner";
setPublicKey(identity, owner, false);
Signature signature = addSignedCommitAndReturnSignature(identity);
assertThat(signature).isEqualTo(new Signature(identity, "gpg", false, owner));
}
@Test
void shouldReturnValidSignature() throws Exception {
String identity = "0xAWESOMExBOB";
String owner = "BobTheSigner";
setPublicKey(identity, owner, true);
Signature signature = addSignedCommitAndReturnSignature(identity);
assertThat(signature).isEqualTo(new Signature(identity, "gpg", true, owner));
}
@Test
void shouldPassDataAndSignatureForVerification() throws Exception {
setPublicKey("0x42", "Me", true);
addSignedCommitAndReturnSignature("0x42");
ArgumentCaptor<byte[]> dataCaptor = ArgumentCaptor.forClass(byte[].class);
ArgumentCaptor<byte[]> signatureCaptor = ArgumentCaptor.forClass(byte[].class);
verify(publicKey).verify(dataCaptor.capture(), signatureCaptor.capture());
String data = new String(dataCaptor.getValue());
assertThat(data).contains("author Bob The Signer <sign@bob.de>");
String signature = new String(signatureCaptor.getValue());
assertThat(signature).contains("BEGIN PGP SIGNATURE", "END PGP SIGNATURE");
}
@Test
void shouldNotReturnSignatureForNonSignedCommit() throws GitAPIException, IOException {
Changeset changeset = commit("Bob", "unsigned@bob.de", "not signed");
assertThat(changeset.getSignatures()).isEmpty();
}
private void setPublicKey(String id, String owner, boolean valid) {
when(gpg.findPublicKeyId(any())).thenReturn(id);
when(gpg.findPublicKey(id)).thenReturn(Optional.of(publicKey));
when(publicKey.getOwner()).thenReturn(Optional.of(owner));
when(publicKey.verify(any(byte[].class), any(byte[].class))).thenReturn(valid);
}
private Signature addSignedCommitAndReturnSignature(String keyIdentity) throws IOException, GitAPIException {
RevCommit commit = addSignedCommit(keyIdentity);
GitChangesetConverterFactory factory = new GitChangesetConverterFactory(gpg);
GitChangesetConverter converter = factory.create(git.getRepository());
List<Signature> signatures = converter.createChangeset(commit).getSignatures();
assertThat(signatures).isNotEmpty().hasSize(1);
return signatures.get(0);
}
private RevCommit addSignedCommit(String keyIdentity) throws IOException, GitAPIException {
addRandomFileToRepository();
return git.commit()
.setAuthor("Bob The Signer", "sign@bob.de")
.setMessage("Signed from Bob")
.setSign(true)
.setSigningKey(keyIdentity)
.call();
}
}
private PGPKeyPair createKeyPair() throws PGPException, NoSuchProviderException, NoSuchAlgorithmException {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA", "BC");
// we use a small key size to speedup test, a much larger size should be used for production
keyPairGenerator.initialize(512);
KeyPair pair = keyPairGenerator.generateKeyPair();
return new JcaPGPKeyPair(PGPPublicKey.RSA_GENERAL, pair, new Date());
}
private static class TestingGpgSigner extends GpgSigner {
private final PGPKeyPair keyPair;
TestingGpgSigner(PGPKeyPair keyPair) {
this.keyPair = keyPair;
}
@Override
public boolean canLocateSigningKey(String gpgSigningKey, PersonIdent committer, CredentialsProvider credentialsProvider) {
return true;
}
@Override
public void sign(CommitBuilder commit, String gpgSigningKey,
PersonIdent committer, CredentialsProvider credentialsProvider) {
try {
if (keyPair == null) {
throw new JGitInternalException(JGitText.get().unableToSignCommitNoSecretKey);
}
PGPPrivateKey privateKey = keyPair.getPrivateKey();
PGPSignatureGenerator signatureGenerator = new PGPSignatureGenerator(
new JcaPGPContentSignerBuilder(
keyPair.getPublicKey().getAlgorithm(),
HashAlgorithmTags.SHA256).setProvider(BouncyCastleProvider.PROVIDER_NAME)
);
signatureGenerator.init(PGPSignature.BINARY_DOCUMENT, privateKey);
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
try (BCPGOutputStream out = new BCPGOutputStream(new ArmoredOutputStream(buffer))) {
signatureGenerator.update(commit.build());
signatureGenerator.generate().encode(out);
}
commit.setGpgSignature(new GpgSignature(buffer.toByteArray()));
} catch (PGPException | IOException e) {
throw new JGitInternalException(e.getMessage(), e);
}
}
}
// register bouncy castle provider on load
static {
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
Security.addProvider(new BouncyCastleProvider());
}
}
}

View File

@@ -0,0 +1,65 @@
/*
* MIT License
*
* Copyright (c) 2020-present Cloudogu GmbH and Contributors
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
package sonia.scm.repository;
import sonia.scm.security.GPG;
import sonia.scm.security.PrivateKey;
import sonia.scm.security.PublicKey;
import java.util.Collections;
import java.util.Optional;
public final class GitTestHelper {
private GitTestHelper() {
}
public static GitChangesetConverterFactory createConverterFactory() {
return new GitChangesetConverterFactory(new NoopGPG());
}
private static class NoopGPG implements GPG {
@Override
public String findPublicKeyId(byte[] signature) {
return "secret-key";
}
@Override
public Optional<PublicKey> findPublicKey(String id) {
return Optional.empty();
}
@Override
public Iterable<PublicKey> findPublicKeysByUsername(String username) {
return Collections.emptySet();
}
@Override
public PrivateKey getPrivateKey() {
return null;
}
}
}

View File

@@ -33,6 +33,7 @@ import org.eclipse.jgit.revwalk.RevCommit;
import sonia.scm.repository.Changeset;
import sonia.scm.repository.GitChangesetConverter;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.repository.client.api.RepositoryClientException;
//~--- JDK imports ------------------------------------------------------------
@@ -72,7 +73,7 @@ public class GitCommitCommand implements CommitCommand
@Override
public Changeset commit(CommitRequest request) throws IOException
{
GitChangesetConverterFactory converterFactory = new GitChangesetConverterFactory();
GitChangesetConverterFactory converterFactory = GitTestHelper.createConverterFactory();
try (GitChangesetConverter converter = converterFactory.create(git.getRepository()))
{
RevCommit commit = git.commit()

View File

@@ -42,6 +42,7 @@ import org.junit.rules.TemporaryFolder;
import sonia.scm.repository.Changeset;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitRepositoryHandler;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.repository.Repository;
import sonia.scm.user.User;
import sonia.scm.user.UserTestData;
@@ -111,7 +112,7 @@ public class AbstractRemoteCommandTestBase
{
// store reference to handle weak references
proto = new ScmTransportProtocol(GitChangesetConverterFactory::new, () -> null, () -> null);
proto = new ScmTransportProtocol(GitTestHelper::createConverterFactory, () -> null, () -> null);
Transport.register(proto);
}

View File

@@ -29,6 +29,7 @@ import org.eclipse.jgit.transport.Transport;
import org.junit.rules.ExternalResource;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitRepositoryHandler;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.repository.PreProcessorUtil;
import sonia.scm.repository.RepositoryManager;
import sonia.scm.repository.api.HookContextFactory;
@@ -43,12 +44,12 @@ public class BindTransportProtocolRule extends ExternalResource {
private ScmTransportProtocol scmTransportProtocol;
@Override
protected void before() throws Throwable {
protected void before() {
HookContextFactory hookContextFactory = new HookContextFactory(mock(PreProcessorUtil.class));
RepositoryManager repositoryManager = mock(RepositoryManager.class);
HookEventFacade hookEventFacade = new HookEventFacade(of(repositoryManager), hookContextFactory);
GitRepositoryHandler gitRepositoryHandler = mock(GitRepositoryHandler.class);
scmTransportProtocol = new ScmTransportProtocol(of(new GitChangesetConverterFactory()), of(hookEventFacade), of(gitRepositoryHandler));
scmTransportProtocol = new ScmTransportProtocol(of(GitTestHelper.createConverterFactory()), of(hookEventFacade), of(gitRepositoryHandler));
Transport.register(scmTransportProtocol);

View File

@@ -33,6 +33,7 @@ import org.junit.Test;
import sonia.scm.api.v2.resources.GitRepositoryConfigStoreProvider;
import sonia.scm.repository.ChangesetPagingResult;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.store.InMemoryConfigurationStoreFactory;
import java.io.IOException;
@@ -178,7 +179,7 @@ public class GitIncomingCommandTest
return new GitIncomingCommand(
new GitContext(incomingDirectory, incomingRepository, new GitRepositoryConfigStoreProvider(new InMemoryConfigurationStoreFactory())),
handler,
new GitChangesetConverterFactory()
GitTestHelper.createConverterFactory()
);
}
}

View File

@@ -28,6 +28,7 @@ import org.junit.Test;
import sonia.scm.NotFoundException;
import sonia.scm.repository.ChangesetPagingResult;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitTestHelper;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
@@ -110,6 +111,6 @@ public class GitLogCommandAncestorTest extends AbstractGitCommandTestBase
}
private GitLogCommand createCommand() {
return new GitLogCommand(createContext(), new GitChangesetConverterFactory());
return new GitLogCommand(createContext(), GitTestHelper.createConverterFactory());
}
}

View File

@@ -33,6 +33,7 @@ import sonia.scm.repository.Changeset;
import sonia.scm.repository.ChangesetPagingResult;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitRepositoryConfig;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.repository.Modifications;
import sonia.scm.repository.Person;
@@ -295,6 +296,6 @@ public class GitLogCommandTest extends AbstractGitCommandTestBase
}
private GitLogCommand createCommand() {
return new GitLogCommand(createContext(), new GitChangesetConverterFactory());
return new GitLogCommand(createContext(), GitTestHelper.createConverterFactory());
}
}

View File

@@ -32,6 +32,7 @@ import org.junit.Test;
import sonia.scm.api.v2.resources.GitRepositoryConfigStoreProvider;
import sonia.scm.repository.ChangesetPagingResult;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.store.InMemoryConfigurationStoreFactory;
import java.io.IOException;
@@ -155,7 +156,7 @@ public class GitOutgoingCommandTest extends AbstractRemoteCommandTestBase
return new GitOutgoingCommand(
new GitContext(outgoingDirectory, outgoingRepository, new GitRepositoryConfigStoreProvider(new InMemoryConfigurationStoreFactory())),
handler,
new GitChangesetConverterFactory()
GitTestHelper.createConverterFactory()
);
}
}

View File

@@ -36,6 +36,7 @@ import org.junit.Test;
import org.junit.rules.TemporaryFolder;
import sonia.scm.repository.GitChangesetConverterFactory;
import sonia.scm.repository.GitRepositoryHandler;
import sonia.scm.repository.GitTestHelper;
import sonia.scm.repository.PreProcessorUtil;
import sonia.scm.repository.RepositoryManager;
import sonia.scm.repository.api.HookContextFactory;
@@ -66,7 +67,7 @@ public class SimpleGitWorkingCopyFactoryTest extends AbstractGitCommandTestBase
HookContextFactory hookContextFactory = new HookContextFactory(mock(PreProcessorUtil.class));
HookEventFacade hookEventFacade = new HookEventFacade(of(mock(RepositoryManager.class)), hookContextFactory);
GitRepositoryHandler gitRepositoryHandler = mock(GitRepositoryHandler.class);
proto = new ScmTransportProtocol(of(new GitChangesetConverterFactory()), of(hookEventFacade), of(gitRepositoryHandler));
proto = new ScmTransportProtocol(of(GitTestHelper.createConverterFactory()), of(hookEventFacade), of(gitRepositoryHandler));
Transport.register(proto);
workdirProvider = new WorkdirProvider(temporaryFolder.newFolder());
}