2017-06-14 09:51:34 +00:00
|
|
|
module Gitlab
|
|
|
|
module Gpg
|
|
|
|
class Commit
|
2018-02-28 16:56:00 +00:00
|
|
|
include Gitlab::Utils::StrongMemoize
|
|
|
|
|
2017-08-24 12:21:26 +00:00
|
|
|
def initialize(commit)
|
|
|
|
@commit = commit
|
2017-06-14 09:51:34 +00:00
|
|
|
|
2018-01-18 14:10:17 +00:00
|
|
|
repo = commit.project.repository.raw_repository
|
2018-02-28 16:56:00 +00:00
|
|
|
@signature_data = Gitlab::Git::Commit.extract_signature_lazily(repo, commit.sha || commit.id)
|
|
|
|
end
|
|
|
|
|
|
|
|
def signature_text
|
|
|
|
strong_memoize(:signature_text) do
|
|
|
|
@signature_data&.itself && @signature_data[0]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def signed_text
|
|
|
|
strong_memoize(:signed_text) do
|
|
|
|
@signature_data&.itself && @signature_data[1]
|
|
|
|
end
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def has_signature?
|
2018-02-28 16:56:00 +00:00
|
|
|
!!(signature_text && signed_text)
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def signature
|
2017-06-15 07:16:50 +00:00
|
|
|
return unless has_signature?
|
|
|
|
|
2017-08-15 11:22:55 +00:00
|
|
|
return @signature if @signature
|
2017-06-15 08:28:28 +00:00
|
|
|
|
2017-08-24 12:21:26 +00:00
|
|
|
cached_signature = GpgSignature.find_by(commit_sha: @commit.sha)
|
2017-08-15 11:22:55 +00:00
|
|
|
return @signature = cached_signature if cached_signature.present?
|
|
|
|
|
|
|
|
@signature = create_cached_signature!
|
2017-06-15 11:37:03 +00:00
|
|
|
end
|
|
|
|
|
2017-06-15 12:18:00 +00:00
|
|
|
def update_signature!(cached_signature)
|
|
|
|
using_keychain do |gpg_key|
|
2017-07-13 13:22:15 +00:00
|
|
|
cached_signature.update_attributes!(attributes(gpg_key))
|
2017-06-15 12:18:00 +00:00
|
|
|
end
|
2017-08-15 11:22:55 +00:00
|
|
|
|
|
|
|
@signature = cached_signature
|
2017-06-15 12:18:00 +00:00
|
|
|
end
|
|
|
|
|
2017-06-15 11:37:03 +00:00
|
|
|
private
|
|
|
|
|
|
|
|
def using_keychain
|
2017-06-14 09:51:34 +00:00
|
|
|
Gitlab::Gpg.using_tmp_keychain do
|
|
|
|
# first we need to get the keyid from the signature to query the gpg
|
|
|
|
# key belonging to the keyid.
|
|
|
|
# This way we can add the key to the temporary keychain and extract
|
|
|
|
# the proper signature.
|
2017-10-04 15:34:50 +00:00
|
|
|
# NOTE: the invoked method is #fingerprint but it's only returning
|
|
|
|
# 16 characters (the format used by keyid) instead of 40.
|
2017-09-28 00:45:19 +00:00
|
|
|
gpg_key = find_gpg_key(verified_signature.fingerprint)
|
2017-06-14 09:51:34 +00:00
|
|
|
|
|
|
|
if gpg_key
|
|
|
|
Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
|
2017-07-06 06:03:16 +00:00
|
|
|
@verified_signature = nil
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
|
2017-06-15 11:37:03 +00:00
|
|
|
yield gpg_key
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def verified_signature
|
2018-02-28 16:56:00 +00:00
|
|
|
@verified_signature ||= GPGME::Crypto.new.verify(signature_text, signed_text: signed_text) do |verified_signature|
|
2017-07-06 06:03:16 +00:00
|
|
|
break verified_signature
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-08-15 11:22:55 +00:00
|
|
|
def create_cached_signature!
|
|
|
|
using_keychain do |gpg_key|
|
2018-02-19 08:21:47 +00:00
|
|
|
signature = GpgSignature.new(attributes(gpg_key))
|
|
|
|
signature.save! unless Gitlab::Database.read_only?
|
|
|
|
signature
|
2017-08-15 11:22:55 +00:00
|
|
|
end
|
2017-07-13 13:22:15 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def attributes(gpg_key)
|
|
|
|
user_infos = user_infos(gpg_key)
|
2017-08-24 12:21:30 +00:00
|
|
|
verification_status = verification_status(gpg_key)
|
2017-07-13 13:22:15 +00:00
|
|
|
|
|
|
|
{
|
2017-08-24 12:21:26 +00:00
|
|
|
commit_sha: @commit.sha,
|
|
|
|
project: @commit.project,
|
2017-06-14 09:51:34 +00:00
|
|
|
gpg_key: gpg_key,
|
2017-09-29 22:55:36 +00:00
|
|
|
gpg_key_primary_keyid: gpg_key&.keyid || verified_signature.fingerprint,
|
2017-07-13 13:22:15 +00:00
|
|
|
gpg_key_user_name: user_infos[:name],
|
|
|
|
gpg_key_user_email: user_infos[:email],
|
2017-08-24 12:21:30 +00:00
|
|
|
verification_status: verification_status
|
2017-07-13 13:22:15 +00:00
|
|
|
}
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
2017-06-15 12:18:00 +00:00
|
|
|
|
2017-08-24 12:21:30 +00:00
|
|
|
def verification_status(gpg_key)
|
2017-08-24 12:22:19 +00:00
|
|
|
return :unknown_key unless gpg_key
|
|
|
|
return :unverified_key unless gpg_key.verified?
|
|
|
|
return :unverified unless verified_signature.valid?
|
2017-08-24 12:21:46 +00:00
|
|
|
|
|
|
|
if gpg_key.verified_and_belongs_to_email?(@commit.committer_email)
|
2017-08-24 12:22:19 +00:00
|
|
|
:verified
|
2017-08-24 12:21:46 +00:00
|
|
|
elsif gpg_key.user.all_emails.include?(@commit.committer_email)
|
2017-08-24 12:22:19 +00:00
|
|
|
:same_user_different_email
|
2017-08-24 12:21:30 +00:00
|
|
|
else
|
2017-08-24 12:22:19 +00:00
|
|
|
:other_user
|
2017-08-24 12:21:30 +00:00
|
|
|
end
|
2017-06-15 12:18:00 +00:00
|
|
|
end
|
2017-07-13 13:22:15 +00:00
|
|
|
|
|
|
|
def user_infos(gpg_key)
|
|
|
|
gpg_key&.verified_user_infos&.first || gpg_key&.user_infos&.first || {}
|
|
|
|
end
|
2017-09-28 00:45:19 +00:00
|
|
|
|
|
|
|
def find_gpg_key(keyid)
|
|
|
|
GpgKey.find_by(primary_keyid: keyid) || GpgKeySubkey.find_by(keyid: keyid)
|
|
|
|
end
|
2017-06-14 09:51:34 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|