Skip to content

Commit 4838f62

Browse files
FStelzergitster
FStelzer
authored and
gitster
committed
ssh signing: provide a textual signing_key_id
For ssh the user.signingkey can be a filename/path or even a literal ssh pubkey. In push certs and textual output we prefer the ssh fingerprint instead. Signed-off-by: Fabian Stelzer <fs@gigacodes.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent fd9e226 commit 4838f62

File tree

3 files changed

+66
-4
lines changed

3 files changed

+66
-4
lines changed

‎gpg-interface.c‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ struct gpg_format {
2424
int (*sign_buffer)(struct strbuf *buffer, struct strbuf *signature,
2525
const char *signing_key);
2626
const char *(*get_default_key)(void);
27+
const char *(*get_key_id)(void);
2728
};
2829

2930
static const char *openpgp_verify_args[] = {
@@ -61,6 +62,8 @@ static int sign_buffer_ssh(struct strbuf *buffer, struct strbuf *signature,
6162

6263
static const char *get_default_ssh_signing_key(void);
6364

65+
static const char *get_ssh_key_id(void);
66+
6467
static struct gpg_format gpg_format[] = {
6568
{
6669
.name = "openpgp",
@@ -70,6 +73,7 @@ static struct gpg_format gpg_format[] = {
7073
.verify_signed_buffer = verify_gpg_signed_buffer,
7174
.sign_buffer = sign_buffer_gpg,
7275
.get_default_key = NULL,
76+
.get_key_id = NULL,
7377
},
7478
{
7579
.name = "x509",
@@ -79,6 +83,7 @@ static struct gpg_format gpg_format[] = {
7983
.verify_signed_buffer = verify_gpg_signed_buffer,
8084
.sign_buffer = sign_buffer_gpg,
8185
.get_default_key = NULL,
86+
.get_key_id = NULL,
8287
},
8388
{
8489
.name = "ssh",
@@ -88,6 +93,7 @@ static struct gpg_format gpg_format[] = {
8893
.verify_signed_buffer = NULL, /* TODO */
8994
.sign_buffer = sign_buffer_ssh,
9095
.get_default_key = get_default_ssh_signing_key,
96+
.get_key_id = get_ssh_key_id,
9197
},
9298
};
9399

@@ -484,6 +490,41 @@ int git_gpg_config(const char *var, const char *value, void *cb)
484490
return 0;
485491
}
486492

493+
static char *get_ssh_key_fingerprint(const char *signing_key)
494+
{
495+
struct child_process ssh_keygen = CHILD_PROCESS_INIT;
496+
int ret = -1;
497+
struct strbuf fingerprint_stdout = STRBUF_INIT;
498+
struct strbuf **fingerprint;
499+
500+
/*
501+
* With SSH Signing this can contain a filename or a public key
502+
* For textual representation we usually want a fingerprint
503+
*/
504+
if (starts_with(signing_key, "ssh-")) {
505+
strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf", "-", NULL);
506+
ret = pipe_command(&ssh_keygen, signing_key,
507+
strlen(signing_key), &fingerprint_stdout, 0,
508+
NULL, 0);
509+
} else {
510+
strvec_pushl(&ssh_keygen.args, "ssh-keygen", "-lf",
511+
configured_signing_key, NULL);
512+
ret = pipe_command(&ssh_keygen, NULL, 0, &fingerprint_stdout, 0,
513+
NULL, 0);
514+
}
515+
516+
if (!!ret)
517+
die_errno(_("failed to get the ssh fingerprint for key '%s'"),
518+
signing_key);
519+
520+
fingerprint = strbuf_split_max(&fingerprint_stdout, ' ', 3);
521+
if (!fingerprint[1])
522+
die_errno(_("failed to get the ssh fingerprint for key '%s'"),
523+
signing_key);
524+
525+
return strbuf_detach(fingerprint[1], NULL);
526+
}
527+
487528
/* Returns the first public key from an ssh-agent to use for signing */
488529
static const char *get_default_ssh_signing_key(void)
489530
{
@@ -532,6 +573,21 @@ static const char *get_default_ssh_signing_key(void)
532573
return default_key;
533574
}
534575

576+
static const char *get_ssh_key_id(void) {
577+
return get_ssh_key_fingerprint(get_signing_key());
578+
}
579+
580+
/* Returns a textual but unique representation of the signing key */
581+
const char *get_signing_key_id(void)
582+
{
583+
if (use_format->get_key_id) {
584+
return use_format->get_key_id();
585+
}
586+
587+
/* GPG/GPGSM only store a key id on this variable */
588+
return get_signing_key();
589+
}
590+
535591
const char *get_signing_key(void)
536592
{
537593
if (configured_signing_key)

‎gpg-interface.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ int sign_buffer(struct strbuf *buffer, struct strbuf *signature,
6464
int git_gpg_config(const char *, const char *, void *);
6565
void set_signing_key(const char *);
6666
const char *get_signing_key(void);
67+
68+
/*
69+
* Returns a textual unique representation of the signing key in use
70+
* Either a GPG KeyID or a SSH Key Fingerprint
71+
*/
72+
const char *get_signing_key_id(void);
6773
int check_signature(const char *payload, size_t plen,
6874
const char *signature, size_t slen,
6975
struct signature_check *sigc);

‎send-pack.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -341,13 +341,13 @@ static int generate_push_cert(struct strbuf *req_buf,
341341
{
342342
const struct ref *ref;
343343
struct string_list_item *item;
344-
char *signing_key = xstrdup(get_signing_key());
344+
char *signing_key_id = xstrdup(get_signing_key_id());
345345
const char *cp, *np;
346346
struct strbuf cert = STRBUF_INIT;
347347
int update_seen = 0;
348348

349349
strbuf_addstr(&cert, "certificate version 0.1\n");
350-
strbuf_addf(&cert, "pusher %s ", signing_key);
350+
strbuf_addf(&cert, "pusher %s ", signing_key_id);
351351
datestamp(&cert);
352352
strbuf_addch(&cert, '\n');
353353
if (args->url && *args->url) {
@@ -374,7 +374,7 @@ static int generate_push_cert(struct strbuf *req_buf,
374374
if (!update_seen)
375375
goto free_return;
376376

377-
if (sign_buffer(&cert, &cert, signing_key))
377+
if (sign_buffer(&cert, &cert, get_signing_key()))
378378
die(_("failed to sign the push certificate"));
379379

380380
packet_buf_write(req_buf, "push-cert%c%s", 0, cap_string);
@@ -386,7 +386,7 @@ static int generate_push_cert(struct strbuf *req_buf,
386386
packet_buf_write(req_buf, "push-cert-end\n");
387387

388388
free_return:
389-
free(signing_key);
389+
free(signing_key_id);
390390
strbuf_release(&cert);
391391
return update_seen;
392392
}

0 commit comments

Comments
 (0)