From 52e2710b709f40037b315fa9a022be4e90b81cb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Fri, 7 Dec 2018 18:34:38 +0100 Subject: [PATCH 01/19] Added gpgverify. --- gpgverify | 111 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100755 gpgverify diff --git a/gpgverify b/gpgverify new file mode 100755 index 0000000..524a396 --- /dev/null +++ b/gpgverify @@ -0,0 +1,111 @@ +#!/bin/bash + +# Copyright 2018 B. Persson, Bjorn@Rombobeorn.se +# +# This material is provided as is, with absolutely no warranty expressed +# or implied. Any use is at your own risk. +# +# Permission is hereby granted to use or copy this shellscript +# for any purpose, provided the above notices are retained on all copies. +# Permission to modify the code and to distribute modified code is granted, +# provided the above notices are retained, and a notice that the code was +# modified is included with the above copyright notice. + + +function print_help { + cat <<'EOF' +Usage: gpgverify --keyring= --signature= --data= + +gpgverify is a wrapper around gpgv designed for easy and safe scripting. It +verifies a file against a detached OpenPGP signature and a keyring. The keyring +shall contain all the keys that are trusted to certify the authenticity of the +file, and must not contain any untrusted keys. + +The differences, compared to invoking gpgv directly, are that gpgverify accepts +the keyring in either ASCII-armored or unarmored form, and that it will not +accidentally use a default keyring in addition to the specified one. + +Parameters: + --keyring= keyring with all the trusted keys and no others + --signature= detached signature to verify + --data= file to verify against the signature +EOF +} + + +fatal_error() { + message="$1" # an error message + status=$2 # a number to use as the exit code + echo "gpgverify: $message" >&2 + exit $status +} + + +require_parameter() { + term="$1" # a term for a required parameter + value="$2" # Complain and terminate if this value is empty. + if test -z "${value}" ; then + fatal_error "No ${term} was provided." 2 + fi +} + + +check_status() { + action="$1" # a string that describes the action that was attempted + status=$2 # the exit code of the command + if test $status -ne 0 ; then + fatal_error "$action failed." $status + fi +} + + +# Parse the command line. +keyring= +signature= +data= +for parameter in "$@" ; do + case "${parameter}" in + (--help) + print_help + exit + ;; + (--keyring=*) + keyring="${parameter#*=}" + ;; + (--signature=*) + signature="${parameter#*=}" + ;; + (--data=*) + data="${parameter#*=}" + ;; + (*) + fatal_error "Unknown parameter: \"${parameter}\"" 2 + ;; + esac +done +require_parameter 'keyring' "${keyring}" +require_parameter 'signature' "${signature}" +require_parameter 'data file' "${data}" + +# Make a temporary working directory. +workdir="$(mktemp --directory)" +check_status 'Making a temporary directory' $? +workring="${workdir}/keyring.gpg" + +# Decode any ASCII armor on the keyring. This is harmless if the keyring isn't +# ASCII-armored. +gpg2 --homedir="${workdir}" --yes --output="${workring}" --dearmor "${keyring}" +check_status 'Decoding the keyring' $? + +# Verify the signature using the decoded keyring. +gpgv2 --homedir="${workdir}" --keyring="${workring}" "${signature}" "${data}" +check_status 'Signature verification' $? + +# (--homedir isn't actually necessary. --dearmor processes only the input file, +# and if --keyring is used and contains a slash, then gpgv2 uses only that +# keyring. Thus neither command will look for a default keyring, but --homedir +# makes extra double sure that no default keyring will be touched in case +# another version of GPG works differently.) + +# Clean up. (This is not done in case of an error that may need inspection.) +rm --recursive --force ${workdir} From ed97fb8dd222b2dbf5085b29a89da76fba0dccb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Tue, 22 Aug 2023 11:27:55 +0200 Subject: [PATCH 02/19] Adjusted the license of gpgverify to match the SPDX "Boehm-GC" wording. --- gpgverify | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gpgverify b/gpgverify index 524a396..93a60d1 100755 --- a/gpgverify +++ b/gpgverify @@ -5,7 +5,7 @@ # This material is provided as is, with absolutely no warranty expressed # or implied. Any use is at your own risk. # -# Permission is hereby granted to use or copy this shellscript +# Permission is hereby granted to use or copy this program # for any purpose, provided the above notices are retained on all copies. # Permission to modify the code and to distribute modified code is granted, # provided the above notices are retained, and a notice that the code was From e4b9bbf707c276fdc22cf1f6df271eea4e3a7c9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Sun, 9 Jul 2023 17:08:55 +0200 Subject: [PATCH 03/19] Fixed gpgverify to allow multiple keyrings. --- gpgverify | 71 +++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 53 insertions(+), 18 deletions(-) diff --git a/gpgverify b/gpgverify index 93a60d1..0ae1570 100755 --- a/gpgverify +++ b/gpgverify @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2018 B. Persson, Bjorn@Rombobeorn.se +# Copyright 2018 – 2023 B. Persson, Bjorn@Rombobeorn.se # # This material is provided as is, with absolutely no warranty expressed # or implied. Any use is at your own risk. @@ -17,16 +17,17 @@ function print_help { Usage: gpgverify --keyring= --signature= --data= gpgverify is a wrapper around gpgv designed for easy and safe scripting. It -verifies a file against a detached OpenPGP signature and a keyring. The keyring -shall contain all the keys that are trusted to certify the authenticity of the -file, and must not contain any untrusted keys. +verifies a file against a detached OpenPGP signature and one or more keyrings. +The keyrings shall together contain all the keys that are trusted to certify +the authenticity of the file, and must not contain any untrusted keys. The differences, compared to invoking gpgv directly, are that gpgverify accepts -the keyring in either ASCII-armored or unarmored form, and that it will not -accidentally use a default keyring in addition to the specified one. +keyrings in either ASCII-armored or unarmored form, and that it will not +accidentally use a default keyring in addition to the specified ones. Parameters: - --keyring= keyring with all the trusted keys and no others + --keyring= keyring with only trusted keys (can be repeated) + --keyrings Multiple keyrings with only trusted keys follow. --signature= detached signature to verify --data= file to verify against the signature EOF @@ -41,11 +42,17 @@ fatal_error() { } +parameter_error() { + message="$1" # an error message + fatal_error "${message}" 2 +} + + require_parameter() { term="$1" # a term for a required parameter value="$2" # Complain and terminate if this value is empty. if test -z "${value}" ; then - fatal_error "No ${term} was provided." 2 + parameter_error "No ${term} was provided." fi } @@ -60,45 +67,73 @@ check_status() { # Parse the command line. -keyring= +keyring_parameters=false +declare -a keyrings signature= data= for parameter in "$@" ; do + if [[ "${parameter}" = -* ]] ; then + # This parameter begins with a dash, so it's not part of any list of + # keyrings. + keyring_parameters=false + fi case "${parameter}" in (--help) print_help exit ;; + (--keyrings) + # The following parameters will be keyring pathnames until one + # begins with a dash. + keyring_parameters=true + ;; (--keyring=*) - keyring="${parameter#*=}" + keyrings+=("${parameter#*=}") ;; (--signature=*) + if test -n "${signature}" ; then + # This is a second occurrence of --signature. + parameter_error 'Only one signature at a time can be verified.' + fi signature="${parameter#*=}" ;; (--data=*) + if test -n "${data}" ; then + # This is a second occurrence of --data. + parameter_error 'Only one data file at a time can be verified.' + fi data="${parameter#*=}" ;; (*) - fatal_error "Unknown parameter: \"${parameter}\"" 2 + if ${keyring_parameters} ; then + keyrings+=("${parameter}") + else + parameter_error "Unknown parameter: \"${parameter}\"" + fi ;; esac done -require_parameter 'keyring' "${keyring}" +require_parameter 'keyring' "${keyrings}" require_parameter 'signature' "${signature}" require_parameter 'data file' "${data}" # Make a temporary working directory. workdir="$(mktemp --directory)" check_status 'Making a temporary directory' $? -workring="${workdir}/keyring.gpg" -# Decode any ASCII armor on the keyring. This is harmless if the keyring isn't +# Decode any ASCII armor on the keyrings. This is harmless if a keyring isn't # ASCII-armored. -gpg2 --homedir="${workdir}" --yes --output="${workring}" --dearmor "${keyring}" -check_status 'Decoding the keyring' $? +number=1 +for keyring in "${keyrings[@]}" ; do + ring="${workdir}/keyring${number}.gpg" + gpg2 --homedir="${workdir}" --yes --output="${ring}" --dearmor "${keyring}" + check_status "Decoding the keyring \"${keyring}\"" $? + keyring_params+=("--keyring=${ring}") + ((++number)) +done -# Verify the signature using the decoded keyring. -gpgv2 --homedir="${workdir}" --keyring="${workring}" "${signature}" "${data}" +# Verify the signature using the decoded keyrings. +gpgv2 --homedir="${workdir}" "${keyring_params[@]}" "${signature}" "${data}" check_status 'Signature verification' $? # (--homedir isn't actually necessary. --dearmor processes only the input file, From 2d0b8f8cf74331831c4796c24fcf8aba9d4e6ced Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Mon, 7 Aug 2023 17:45:05 +0200 Subject: [PATCH 04/19] Extended gpgverify to handle non-detached signatures. --- gpgverify | 57 +++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 47 insertions(+), 10 deletions(-) diff --git a/gpgverify b/gpgverify index 0ae1570..0815852 100755 --- a/gpgverify +++ b/gpgverify @@ -14,22 +14,39 @@ function print_help { cat <<'EOF' -Usage: gpgverify --keyring= --signature= --data= - gpgverify is a wrapper around gpgv designed for easy and safe scripting. It -verifies a file against a detached OpenPGP signature and one or more keyrings. -The keyrings shall together contain all the keys that are trusted to certify -the authenticity of the file, and must not contain any untrusted keys. +verifies a file against an OpenPGP signature and one or more keyrings. The +keyrings shall together contain all the keys that are trusted to certify the +authenticity of the file, and must not contain any untrusted keys. + +To verify a detached signature, where the signature and the signed data are two +separate files, both --signature and --data must be given: + gpgverify --keyring= --signature= --data= + gpgverify --keyrings ... --signature= --data= + +If the signature is embedded in the signed file, give --data and --output: + gpgverify --keyring= --data= --output= + gpgverify --keyrings ... --data= --output= + +The verified data will be written to the output file. An output file is required +even for a clearsigned text file, because a clearsigned block can be surrounded +by unsigned text. A program that trusts the contents of a clearsigned file after +verifying the signature is vulnerable to spoofing. Only the contents of the +output file can be trusted. The differences, compared to invoking gpgv directly, are that gpgverify accepts -keyrings in either ASCII-armored or unarmored form, and that it will not -accidentally use a default keyring in addition to the specified ones. +keyrings in either ASCII-armored or unarmored form, that it won't accidentally +use a default keyring in addition to the specified ones, and that it insists on +writing an output file if the signature is not detached. Parameters: --keyring= keyring with only trusted keys (can be repeated) --keyrings Multiple keyrings with only trusted keys follow. --signature= detached signature to verify - --data= file to verify against the signature + --data= signed file to verify, or data file to verify against + a detached signature + --output= file to write the verified data to when the signature + is embedded in the signed file EOF } @@ -71,6 +88,7 @@ keyring_parameters=false declare -a keyrings signature= data= +output= for parameter in "$@" ; do if [[ "${parameter}" = -* ]] ; then # This parameter begins with a dash, so it's not part of any list of @@ -104,6 +122,13 @@ for parameter in "$@" ; do fi data="${parameter#*=}" ;; + (--output=*) + if test -n "${output}" ; then + # This is a second occurrence of --output. + parameter_error 'Only one output file can be written.' + fi + output="${parameter#*=}" + ;; (*) if ${keyring_parameters} ; then keyrings+=("${parameter}") @@ -114,9 +139,18 @@ for parameter in "$@" ; do esac done require_parameter 'keyring' "${keyrings}" -require_parameter 'signature' "${signature}" require_parameter 'data file' "${data}" +# If no detached signature is provided, then the signature is embedded in the +# data file, and there must be an output file to write the verified data to – +# even if the data file is clearsigned. +if test -z "${signature}${output}" ; then + msg='Neither a signature nor an output file was provided. ' + msg+='Trusting a clearsigned file witout stripping off unsigned text ' + msg+='makes you vulnerable to spoofing.' + parameter_error "${msg}" +fi + # Make a temporary working directory. workdir="$(mktemp --directory)" check_status 'Making a temporary directory' $? @@ -133,7 +167,10 @@ for keyring in "${keyrings[@]}" ; do done # Verify the signature using the decoded keyrings. -gpgv2 --homedir="${workdir}" "${keyring_params[@]}" "${signature}" "${data}" +# The signature pathname shall be a single parameter even if it contains +# whitespace, but shall be omitted entirely if it's an empty string. +gpgv2 --homedir="${workdir}" "${keyring_params[@]}" \ + ${output:+"--output=${output}"} ${signature:+"${signature}"} "${data}" check_status 'Signature verification' $? # (--homedir isn't actually necessary. --dearmor processes only the input file, From 318d0de0cd03fadadc29108cc8a4cc26ae36b1fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Mon, 7 Aug 2023 18:18:16 +0200 Subject: [PATCH 05/19] consistent function definition style in gpgverify --- gpgverify | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gpgverify b/gpgverify index 0815852..01379ff 100755 --- a/gpgverify +++ b/gpgverify @@ -51,7 +51,7 @@ EOF } -fatal_error() { +function fatal_error { message="$1" # an error message status=$2 # a number to use as the exit code echo "gpgverify: $message" >&2 @@ -59,13 +59,13 @@ fatal_error() { } -parameter_error() { +function parameter_error { message="$1" # an error message fatal_error "${message}" 2 } -require_parameter() { +function require_parameter { term="$1" # a term for a required parameter value="$2" # Complain and terminate if this value is empty. if test -z "${value}" ; then @@ -74,7 +74,7 @@ require_parameter() { } -check_status() { +function check_status { action="$1" # a string that describes the action that was attempted status=$2 # the exit code of the command if test $status -ne 0 ; then From aeed4d45e4f271fdee46c0ea6af32518f9e71212 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Thu, 10 Aug 2023 08:37:18 +0200 Subject: [PATCH 06/19] Changed gpgverify to dearmor only armored keyrings. Although the --dearmor command accepts both armored and unarmored keyrings, it rejects keybox files. To enable the use of keyboxes, keys are now passed through --dearmor only if they contain an armor header line. --- gpgverify | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/gpgverify b/gpgverify index 01379ff..877b82b 100755 --- a/gpgverify +++ b/gpgverify @@ -155,15 +155,24 @@ fi workdir="$(mktemp --directory)" check_status 'Making a temporary directory' $? -# Decode any ASCII armor on the keyrings. This is harmless if a keyring isn't -# ASCII-armored. +# Decode any ASCII armor on the keyrings. number=1 for keyring in "${keyrings[@]}" ; do - ring="${workdir}/keyring${number}.gpg" - gpg2 --homedir="${workdir}" --yes --output="${ring}" --dearmor "${keyring}" - check_status "Decoding the keyring \"${keyring}\"" $? + if grep --quiet '^-----BEGIN PGP PUBLIC KEY BLOCK-----' "${keyring}" ; then + # This looks like an ASCII-armored keyring. + ring="${workdir}/keyring${number}.gpg" + gpg2 --homedir="${workdir}" --yes --output="${ring}" --dearmor \ + "${keyring}" + check_status "Decoding the keyring \"${keyring}\"" $? + ((++number)) + else + # This is not an ASCII-armored keyring. Don't dearmor it, but ensure + # that the pathname contains slashes to prevent GnuPG from looking for + # the file in the wrong place. + ring=`realpath "${keyring}" --canonicalize-existing` + check_status 'Accessing a keyring' $? + fi keyring_params+=("--keyring=${ring}") - ((++number)) done # Verify the signature using the decoded keyrings. From 21af2f5182479ab8a41c39fe0ad84e63a3c145c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Sun, 3 Mar 2024 20:14:06 +0100 Subject: [PATCH 07/19] typo --- gpgverify | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gpgverify b/gpgverify index 877b82b..9fc01f9 100755 --- a/gpgverify +++ b/gpgverify @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2018 – 2023 B. Persson, Bjorn@Rombobeorn.se +# Copyright 2018 – 2024 B. Persson, Bjorn@Rombobeorn.se # # This material is provided as is, with absolutely no warranty expressed # or implied. Any use is at your own risk. @@ -146,7 +146,7 @@ require_parameter 'data file' "${data}" # even if the data file is clearsigned. if test -z "${signature}${output}" ; then msg='Neither a signature nor an output file was provided. ' - msg+='Trusting a clearsigned file witout stripping off unsigned text ' + msg+='Trusting a clearsigned file without stripping off unsigned text ' msg+='makes you vulnerable to spoofing.' parameter_error "${msg}" fi From a3dd2b1c74af22e48e97e641a49af7d7a504ef1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Wed, 22 Jan 2025 15:24:54 +0100 Subject: [PATCH 08/19] Added testcases to test gpgverify. --- tests/gpgverify/armored/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/armored/dummy.tar.gz.asc | 7 ++ .../armored/gpgverify-test-armored.spec | 21 ++++ tests/gpgverify/armored/key.asc | 9 ++ tests/gpgverify/armored/main.fmf | 1 + tests/gpgverify/bad-signer/dummy.tar.gz | Bin 0 -> 329 bytes tests/gpgverify/bad-signer/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../bad-signer/gpgverify-test-bad-signer.spec | 20 ++++ tests/gpgverify/bad-signer/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/bad-signer/main.fmf | 5 + tests/gpgverify/bad-tarball/dummy.tar.gz | Bin 0 -> 329 bytes tests/gpgverify/bad-tarball/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../gpgverify-test-bad-tarball.spec | 21 ++++ tests/gpgverify/bad-tarball/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/bad-tarball/main.fmf | 5 + tests/gpgverify/bad-usage/dummy.txt.asc | 18 ++++ .../bad-usage/gpgverify-test-bad-usage.spec | 22 ++++ tests/gpgverify/bad-usage/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/bad-usage/main.fmf | 5 + tests/gpgverify/clearsigned/dummy.txt.asc | 18 ++++ .../gpgverify-test-clearsigned.spec | 23 ++++ tests/gpgverify/clearsigned/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/clearsigned/main.fmf | 5 + tests/gpgverify/expired/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/expired/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../expired/gpgverify-test-expired.spec | 21 ++++ tests/gpgverify/expired/key.gpg | Bin 0 -> 220 bytes tests/gpgverify/expired/main.fmf | 1 + tests/gpgverify/invalid-keyring/dummy.tar.gz | Bin 0 -> 327 bytes .../invalid-keyring/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../gpgverify-test-invalid-keyring.spec | 20 ++++ tests/gpgverify/invalid-keyring/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/invalid-keyring/main.fmf | 5 + .../gpgverify/invalid-signature/dummy.tar.gz | Bin 0 -> 327 bytes .../invalid-signature/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../gpgverify-test-invalid-signature.spec | 20 ++++ tests/gpgverify/invalid-signature/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/invalid-signature/main.fmf | 5 + tests/gpgverify/keybox/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/keybox/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../keybox/gpgverify-test-keybox.spec | 20 ++++ tests/gpgverify/keybox/key.kbx | Bin 0 -> 396 bytes tests/gpgverify/keybox/main.fmf | 1 + tests/gpgverify/main.fmf | 11 ++ tests/gpgverify/stdin/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/stdin/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../gpgverify/stdin/gpgverify-test-stdin.spec | 21 ++++ tests/gpgverify/stdin/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/stdin/main.fmf | 1 + tests/gpgverify/test-rpmbuild | 102 ++++++++++++++++++ tests/gpgverify/two-keys/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/two-keys/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../two-keys/gpgverify-test-two-keys.spec | 21 ++++ tests/gpgverify/two-keys/key-1.gpg | Bin 0 -> 214 bytes tests/gpgverify/two-keys/key-2.gpg | Bin 0 -> 214 bytes tests/gpgverify/two-keys/main.fmf | 1 + tests/gpgverify/unarmored/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/unarmored/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../unarmored/gpgverify-test-unarmored.spec | 21 ++++ tests/gpgverify/unarmored/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/unarmored/main.fmf | 1 + tests/gpgverify/wildcard/dummy.tar.gz | Bin 0 -> 327 bytes tests/gpgverify/wildcard/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../wildcard/gpgverify-test-wildcard.spec | 21 ++++ tests/gpgverify/wildcard/key-1.gpg | Bin 0 -> 214 bytes tests/gpgverify/wildcard/key-2.gpg | Bin 0 -> 214 bytes tests/gpgverify/wildcard/main.fmf | 1 + 67 files changed, 474 insertions(+) create mode 100644 tests/gpgverify/armored/dummy.tar.gz create mode 100644 tests/gpgverify/armored/dummy.tar.gz.asc create mode 100644 tests/gpgverify/armored/gpgverify-test-armored.spec create mode 100644 tests/gpgverify/armored/key.asc create mode 100644 tests/gpgverify/armored/main.fmf create mode 100644 tests/gpgverify/bad-signer/dummy.tar.gz create mode 100644 tests/gpgverify/bad-signer/dummy.tar.gz.sig create mode 100644 tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec create mode 100644 tests/gpgverify/bad-signer/key.gpg create mode 100644 tests/gpgverify/bad-signer/main.fmf create mode 100644 tests/gpgverify/bad-tarball/dummy.tar.gz create mode 100644 tests/gpgverify/bad-tarball/dummy.tar.gz.sig create mode 100644 tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec create mode 100644 tests/gpgverify/bad-tarball/key.gpg create mode 100644 tests/gpgverify/bad-tarball/main.fmf create mode 100644 tests/gpgverify/bad-usage/dummy.txt.asc create mode 100644 tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec create mode 100644 tests/gpgverify/bad-usage/key.gpg create mode 100644 tests/gpgverify/bad-usage/main.fmf create mode 100644 tests/gpgverify/clearsigned/dummy.txt.asc create mode 100644 tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec create mode 100644 tests/gpgverify/clearsigned/key.gpg create mode 100644 tests/gpgverify/clearsigned/main.fmf create mode 100644 tests/gpgverify/expired/dummy.tar.gz create mode 100644 tests/gpgverify/expired/dummy.tar.gz.sig create mode 100644 tests/gpgverify/expired/gpgverify-test-expired.spec create mode 100644 tests/gpgverify/expired/key.gpg create mode 100644 tests/gpgverify/expired/main.fmf create mode 100644 tests/gpgverify/invalid-keyring/dummy.tar.gz create mode 100644 tests/gpgverify/invalid-keyring/dummy.tar.gz.sig create mode 100644 tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec create mode 100644 tests/gpgverify/invalid-keyring/key.gpg create mode 100644 tests/gpgverify/invalid-keyring/main.fmf create mode 100644 tests/gpgverify/invalid-signature/dummy.tar.gz create mode 100644 tests/gpgverify/invalid-signature/dummy.tar.gz.sig create mode 100644 tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec create mode 100644 tests/gpgverify/invalid-signature/key.gpg create mode 100644 tests/gpgverify/invalid-signature/main.fmf create mode 100644 tests/gpgverify/keybox/dummy.tar.gz create mode 100644 tests/gpgverify/keybox/dummy.tar.gz.sig create mode 100644 tests/gpgverify/keybox/gpgverify-test-keybox.spec create mode 100644 tests/gpgverify/keybox/key.kbx create mode 100644 tests/gpgverify/keybox/main.fmf create mode 100644 tests/gpgverify/main.fmf create mode 100644 tests/gpgverify/stdin/dummy.tar.gz create mode 100644 tests/gpgverify/stdin/dummy.tar.gz.sig create mode 100644 tests/gpgverify/stdin/gpgverify-test-stdin.spec create mode 100644 tests/gpgverify/stdin/key.gpg create mode 100644 tests/gpgverify/stdin/main.fmf create mode 100755 tests/gpgverify/test-rpmbuild create mode 100644 tests/gpgverify/two-keys/dummy.tar.gz create mode 100644 tests/gpgverify/two-keys/dummy.tar.gz.sig create mode 100644 tests/gpgverify/two-keys/gpgverify-test-two-keys.spec create mode 100644 tests/gpgverify/two-keys/key-1.gpg create mode 100644 tests/gpgverify/two-keys/key-2.gpg create mode 100644 tests/gpgverify/two-keys/main.fmf create mode 100644 tests/gpgverify/unarmored/dummy.tar.gz create mode 100644 tests/gpgverify/unarmored/dummy.tar.gz.sig create mode 100644 tests/gpgverify/unarmored/gpgverify-test-unarmored.spec create mode 100644 tests/gpgverify/unarmored/key.gpg create mode 100644 tests/gpgverify/unarmored/main.fmf create mode 100644 tests/gpgverify/wildcard/dummy.tar.gz create mode 100644 tests/gpgverify/wildcard/dummy.tar.gz.sig create mode 100644 tests/gpgverify/wildcard/gpgverify-test-wildcard.spec create mode 100644 tests/gpgverify/wildcard/key-1.gpg create mode 100644 tests/gpgverify/wildcard/key-2.gpg create mode 100644 tests/gpgverify/wildcard/main.fmf diff --git a/tests/gpgverify/armored/dummy.tar.gz b/tests/gpgverify/armored/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/armored/dummy.tar.gz.asc b/tests/gpgverify/armored/dummy.tar.gz.asc new file mode 100644 index 0000000..deb52a5 --- /dev/null +++ b/tests/gpgverify/armored/dummy.tar.gz.asc @@ -0,0 +1,7 @@ +-----BEGIN PGP SIGNATURE----- + +iHUEABYKAB0WIQR9GjJ6xDDwYQebheulmOS1Lv+uEQUCZ4D1CwAKCRClmOS1Lv+u +EWl2AQCrOjyhqoudwwZpec/01Mr71sLaY9ZTiLcMrpPgEAzMLAEA1X1mkbso14nh +gK98UWd+rNV2cKq2S2obVuElQ5KiqQw= +=88Ke +-----END PGP SIGNATURE----- diff --git a/tests/gpgverify/armored/gpgverify-test-armored.spec b/tests/gpgverify/armored/gpgverify-test-armored.spec new file mode 100644 index 0000000..4bbdf6a --- /dev/null +++ b/tests/gpgverify/armored/gpgverify-test-armored.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-armored +Version: 1 +Release: 1 +Summary: gpgverify testcase, ASCII-armored files +License: FSFAP +Source1: key.asc +Source2: dummy.tar.gz +Source3: dummy.tar.gz.asc +BuildRequires: gnupg2 + +%description +This tests signature verification where the key and the signature are ASCII- +armored. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/armored/key.asc b/tests/gpgverify/armored/key.asc new file mode 100644 index 0000000..8536cd1 --- /dev/null +++ b/tests/gpgverify/armored/key.asc @@ -0,0 +1,9 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mDMEZ4DMQxYJKwYBBAHaRw8BAQdAhKAEwrtQ/pllxlghuM7ay7OZgTkLz1aMxu2d +hEN/Tia0CnRlc3Qga2V5IDGIkwQTFgoAOxYhBH0aMnrEMPBhB5uF66WY5LUu/64R +BQJngMxDAhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEKWY5LUu/64R +uvABAMqGHRsYw/Vs70axCgENNQ1jJuIKU6x6Sb5F4p5TETqIAP9edVC13EvH03zy +xjbJblfWaNwsA4Z5lTasp7NTKUg0Cw== +=LJAl +-----END PGP PUBLIC KEY BLOCK----- diff --git a/tests/gpgverify/armored/main.fmf b/tests/gpgverify/armored/main.fmf new file mode 100644 index 0000000..fe5ecb3 --- /dev/null +++ b/tests/gpgverify/armored/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, ASCII-armored files diff --git a/tests/gpgverify/bad-signer/dummy.tar.gz b/tests/gpgverify/bad-signer/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..cb6bde6823f26139f9ce2c97048d7f0e438ec108 GIT binary patch literal 329 zcmb2|=3oE==C>DP^O_BK*bC-aw(?&v)VLs*5PpL-NT^NKW7Ux@kH2x}%0{S()vVz^ zMW*NTx9&af_x%s7y7~XpnJ1B9FAeo8!b9i3+pm@X`~KT!f2X?!s!dsMbe8>p&42!P z78`4oQcW}Y9{n`nvi4r5`qCoc^xm5nW-e8JKK+H;!h@N4I|GYfwM{X9dGSZ1YmeHt zjkjEyFWT^3m%it_YIe-O|5Q z%dy3Pmx>(kYxl;@@GV`Nw-$zryi^H|-{jY{$B6|O4m U+nl^5e8P;3$}dx6?6bXC0BMXc2LJ#7 literal 0 HcmV?d00001 diff --git a/tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec b/tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec new file mode 100644 index 0000000..7033130 --- /dev/null +++ b/tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec @@ -0,0 +1,20 @@ +Name: gpgverify-test-bad-signer +Version: 1 +Release: 1 +Summary: gpgverify testcase, bad signer +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +Building this package shall fail because the signature is made with another key. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/bad-signer/key.gpg b/tests/gpgverify/bad-signer/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/bad-signer/main.fmf b/tests/gpgverify/bad-signer/main.fmf new file mode 100644 index 0000000..d74d5da --- /dev/null +++ b/tests/gpgverify/bad-signer/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, bad signer + +environment: + test_kind: "negative" + required_output: "gpgverify: Signature verification failed." diff --git a/tests/gpgverify/bad-tarball/dummy.tar.gz b/tests/gpgverify/bad-tarball/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..cb6bde6823f26139f9ce2c97048d7f0e438ec108 GIT binary patch literal 329 zcmb2|=3oE==C>DP^O_BK*bC-aw(?&v)VLs*5PpL-NT^NKW7Ux@kH2x}%0{S()vVz^ zMW*NTx9&af_x%s7y7~XpnJ1B9FAeo8!b9i3+pm@X`~KT!f2X?!s!dsMbe8>p&42!P z78`4oQcW}Y9{n`nvi4r5`qCoc^xm5nW-e8JKK+H;!h@N4I|GYfwM{X9dGSZ1YmeHt zjkjEyFWT^3m%it_YIe-O|5Q z%+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec b/tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec new file mode 100644 index 0000000..1635823 --- /dev/null +++ b/tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-bad-tarball +Version: 1 +Release: 1 +Summary: gpgverify testcase, bad tarball +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +Building this package shall fail because the tarball doesn't match the +signature. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/bad-tarball/key.gpg b/tests/gpgverify/bad-tarball/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/bad-tarball/main.fmf b/tests/gpgverify/bad-tarball/main.fmf new file mode 100644 index 0000000..63c196f --- /dev/null +++ b/tests/gpgverify/bad-tarball/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, bad tarball + +environment: + test_kind: "negative" + required_output: "gpgverify: Signature verification failed." diff --git a/tests/gpgverify/bad-usage/dummy.txt.asc b/tests/gpgverify/bad-usage/dummy.txt.asc new file mode 100644 index 0000000..29e9344 --- /dev/null +++ b/tests/gpgverify/bad-usage/dummy.txt.asc @@ -0,0 +1,18 @@ +unsigned garbage +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +Copying and distribution of this file, with or without modification, are +permitted in any medium without royalty provided the copyright notice and +this notice are preserved. This file is offered as-is, without any warranty. + +This file represents a clearsigned text file. +-----BEGIN PGP SIGNATURE----- + +iHUEARYKAB0WIQR9GjJ6xDDwYQebheulmOS1Lv+uEQUCZ4D22wAKCRClmOS1Lv+u +Ef/pAP9JuYRLjob/bRWanpPMo7gW0KpE9qE2dbwGHeBfLKi/4QD+MGTlpEZOam1W +AAsUsGu586wv3q9TTGOmITmokrkl7Q4= +=lunw +unsigned garbage +-----END PGP SIGNATURE----- +unsigned garbage diff --git a/tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec b/tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec new file mode 100644 index 0000000..12e7138 --- /dev/null +++ b/tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec @@ -0,0 +1,22 @@ +Name: gpgverify-test-bad-usage +Version: 1 +Release: 1 +Summary: gpgverify testcase, insecure clearsigned usage +License: FSFAP +Source1: key.gpg +Source2: dummy.txt.asc +BuildRequires: gnupg2 + +%description +Building this package shall fail because it tries to verify a clearsigned text +file in an insecure way. The --output parameter is missing. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' +echo 'Execution of prep continues.' +# A naive packager would now pass dummy.txt.asc directly to some other program, +# thinking it has been verified, unaware that it contains unsigned parts. + +%changelog +* Sat Jan 11 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/bad-usage/key.gpg b/tests/gpgverify/bad-usage/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/bad-usage/main.fmf b/tests/gpgverify/bad-usage/main.fmf new file mode 100644 index 0000000..8e5dee5 --- /dev/null +++ b/tests/gpgverify/bad-usage/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, insecure clearsigned usage + +environment: + test_kind: "negative" + required_output: "gpgverify: Neither a signature nor an output file was provided." diff --git a/tests/gpgverify/clearsigned/dummy.txt.asc b/tests/gpgverify/clearsigned/dummy.txt.asc new file mode 100644 index 0000000..29e9344 --- /dev/null +++ b/tests/gpgverify/clearsigned/dummy.txt.asc @@ -0,0 +1,18 @@ +unsigned garbage +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +Copying and distribution of this file, with or without modification, are +permitted in any medium without royalty provided the copyright notice and +this notice are preserved. This file is offered as-is, without any warranty. + +This file represents a clearsigned text file. +-----BEGIN PGP SIGNATURE----- + +iHUEARYKAB0WIQR9GjJ6xDDwYQebheulmOS1Lv+uEQUCZ4D22wAKCRClmOS1Lv+u +Ef/pAP9JuYRLjob/bRWanpPMo7gW0KpE9qE2dbwGHeBfLKi/4QD+MGTlpEZOam1W +AAsUsGu586wv3q9TTGOmITmokrkl7Q4= +=lunw +unsigned garbage +-----END PGP SIGNATURE----- +unsigned garbage diff --git a/tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec b/tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec new file mode 100644 index 0000000..9b26ac9 --- /dev/null +++ b/tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec @@ -0,0 +1,23 @@ +Name: gpgverify-test-clearsigned +Version: 1 +Release: 1 +Summary: gpgverify testcase, clearsigned text file +License: FSFAP +Source1: key.gpg +Source2: dummy.txt.asc +BuildRequires: gnupg2 + +%description +This tests verifying a clearsigned text file. The clearsigned file includes +unsigned parts, which must be excluded from the verified text. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --output=verified.txt +echo 'Execution of prep continues.' +# The verified text would now be processed by some other program, such as +# sha512sum. Here it's instead output for inspection by test-rpmbuild. +cat verified.txt + +%changelog +* Sat Jan 11 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/clearsigned/key.gpg b/tests/gpgverify/clearsigned/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/clearsigned/main.fmf b/tests/gpgverify/clearsigned/main.fmf new file mode 100644 index 0000000..1b0e858 --- /dev/null +++ b/tests/gpgverify/clearsigned/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, clearsigned text file + +environment: + required_output: "This file represents a clearsigned text file." + forbidden_output: "garbage" diff --git a/tests/gpgverify/expired/dummy.tar.gz b/tests/gpgverify/expired/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/expired/dummy.tar.gz.sig b/tests/gpgverify/expired/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..06fc4e73ee0f9e014936de29477bfa355fee50df GIT binary patch literal 119 zcmeAuWnmEGVvrS6WN9;7&cAMc+mgL1i656f`u{k!gtvi}DZSzAG6pVA0hq|4LWch? zi}|#soK!6~yW1ybV`0*JVcsnRl{Z=Ej(^&{l5w`9I>UbtP1A+H-%QjHVvGuU#T2?E Ve$ppR$Bh!tn5}GBCgogY1OS;lGR6P^ literal 0 HcmV?d00001 diff --git a/tests/gpgverify/expired/gpgverify-test-expired.spec b/tests/gpgverify/expired/gpgverify-test-expired.spec new file mode 100644 index 0000000..d85b075 --- /dev/null +++ b/tests/gpgverify/expired/gpgverify-test-expired.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-expired +Version: 1 +Release: 1 +Summary: gpgverify testcase, expired key +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests signature verification with an expired key. Rebuilds shall not fail +just because the clock has ticked past an arbitrary date. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/expired/key.gpg b/tests/gpgverify/expired/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..84cdcd63cd755b278c7e3de66965121006ad370d GIT binary patch literal 220 zcmbPX%#z-4X1y4vHX9=g<1Kf7Mn-lA|3aynk2RS`9iIeiP3QDd*`I#U_=u#yYrl+? zRWoup&9-orq!yPbWT#dt7KyX){~SzixiplD#U4AD2G*|2VaTw}F)j zWIU5JGb<+p(_#izZcYw%CMG2&Hc>844sIqEF(zh4COLK{@dgGiP63#%^$HCCE4#T~ z#>Ae;v0bmBt2DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-keyring/dummy.tar.gz.sig b/tests/gpgverify/invalid-keyring/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..3cef4c636d4a4eaaef5300c97d741f6b4d5328a8 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WT}-hsybruA(4G{>+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec b/tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec new file mode 100644 index 0000000..91ca978 --- /dev/null +++ b/tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec @@ -0,0 +1,20 @@ +Name: gpgverify-test-invalid-keyring +Version: 1 +Release: 1 +Summary: gpgverify testcase, invalid keyring +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +Building this package shall fail because the keyring is invalid. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/invalid-keyring/key.gpg b/tests/gpgverify/invalid-keyring/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..1cceb778493bb72e8cfe485850113514919cf14a GIT binary patch literal 214 zcmbPf%#zV?##xM0myMBy@s>M3BO|**%K{eH-2wk*rXGt>-0|(!>CH16ExFH!^&ERU zx5cI2Pi+fVNoqxjLUv-MfjYVu z(i_e=Gf6YEa&vO9Gcl<%v59hVa&R*#h%qrUGRd(si8nBCaSFiH@A|;VaH>sKTH^56 zocC@UxfprPc$3v0aTTwr^4#b8XkM_ORR_cWxX^&Dcf5~ZuK9G##MLkSTE-n6=C;bI OW^0yj4%YOr;06FtAWZlG literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-keyring/main.fmf b/tests/gpgverify/invalid-keyring/main.fmf new file mode 100644 index 0000000..1cdb098 --- /dev/null +++ b/tests/gpgverify/invalid-keyring/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, invalid keyring + +environment: + test_kind: "negative" + required_output: "gpgverify: Signature verification failed." diff --git a/tests/gpgverify/invalid-signature/dummy.tar.gz b/tests/gpgverify/invalid-signature/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-signature/dummy.tar.gz.sig b/tests/gpgverify/invalid-signature/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..72dc39d7a0f77bbb3d23325ee4bdf3ddf1e8c831 GIT binary patch literal 119 zcmV--0EqvpVFUmc4FDb%Aq0IIGJ3=?@L>m=h3lo5#I-K}t`P+SW`Oke0162ZrI_Tk zF8{6(a-snKF3i6vczUT1bM>-QnLhwh)ZeSZ{E^#PgS*BkhJ@aN0RYK&+Zi${5T5n? Z<+9-0>0FPwKmoI#FF?Ku7)Rv|asm*MHqHP5 literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec b/tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec new file mode 100644 index 0000000..c1171aa --- /dev/null +++ b/tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec @@ -0,0 +1,20 @@ +Name: gpgverify-test-invalid-signature +Version: 1 +Release: 1 +Summary: gpgverify testcase, invalid signature +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +Building this package shall fail because the signature is invalid. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/invalid-signature/key.gpg b/tests/gpgverify/invalid-signature/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-signature/main.fmf b/tests/gpgverify/invalid-signature/main.fmf new file mode 100644 index 0000000..a2cd4a8 --- /dev/null +++ b/tests/gpgverify/invalid-signature/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, invalid signature + +environment: + test_kind: "negative" + required_output: "gpgverify: Signature verification failed." diff --git a/tests/gpgverify/keybox/dummy.tar.gz b/tests/gpgverify/keybox/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/keybox/dummy.tar.gz.sig b/tests/gpgverify/keybox/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..3cef4c636d4a4eaaef5300c97d741f6b4d5328a8 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WT}-hsybruA(4G{>+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/keybox/gpgverify-test-keybox.spec b/tests/gpgverify/keybox/gpgverify-test-keybox.spec new file mode 100644 index 0000000..e7dc906 --- /dev/null +++ b/tests/gpgverify/keybox/gpgverify-test-keybox.spec @@ -0,0 +1,20 @@ +Name: gpgverify-test-keybox +Version: 1 +Release: 1 +Summary: gpgverify testcase, key in a keybox file +License: FSFAP +Source1: key.kbx +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests signature verification with a key in the keybox format. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Sun Jan 12 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/keybox/key.kbx b/tests/gpgverify/keybox/key.kbx new file mode 100644 index 0000000000000000000000000000000000000000..6e36b12f0bf0edff4f0fc6217a7deb30659da413 GIT binary patch literal 396 zcmZQzU{GLWWMJ}kib!K%U|>jZPSOTp5E}v*bC?*xtT+Y+hF=Vf3^KJ+MpZ`)J|wcw zZhgIU#*?jj|JMmJFfb^X_7 zx7_&|8QC3L7O))J9q?~v>ahsL9p`SH-aNC>lKXsE&#||2Tb%3t)Hd)iFr*ixLmb7h zg{vgBxI`g4wNk+lD#HY^r(-gUuoxGEwU{CcHW#xpfvjedW@hE)KVv zW?~UzVrFELV`ma?VBq2ufcbFO2S$cdZL-o5hri~$ciYIt$ZN`*toDd2cuke(KG#R{ zf(5NQ82-nV25i0Kef)CGr(_Qwl6Mwp VWo*6mj5}8KcUienn{xZhr2v@baH{|S literal 0 HcmV?d00001 diff --git a/tests/gpgverify/keybox/main.fmf b/tests/gpgverify/keybox/main.fmf new file mode 100644 index 0000000..ec06f69 --- /dev/null +++ b/tests/gpgverify/keybox/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, key in a keybox file diff --git a/tests/gpgverify/main.fmf b/tests/gpgverify/main.fmf new file mode 100644 index 0000000..1a1d514 --- /dev/null +++ b/tests/gpgverify/main.fmf @@ -0,0 +1,11 @@ +# The gpgverify testcases have these data in common. The details that differ +# are in the subdirectories. + +require: + - rpm-build + - gnupg2 + - grep + +test: ../test-rpmbuild +# ".." because it's apparently relative to the subdirectory of each testcase, +# not relative to this file. diff --git a/tests/gpgverify/stdin/dummy.tar.gz b/tests/gpgverify/stdin/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/stdin/dummy.tar.gz.sig b/tests/gpgverify/stdin/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..3cef4c636d4a4eaaef5300c97d741f6b4d5328a8 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WT}-hsybruA(4G{>+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/stdin/gpgverify-test-stdin.spec b/tests/gpgverify/stdin/gpgverify-test-stdin.spec new file mode 100644 index 0000000..a04dc15 --- /dev/null +++ b/tests/gpgverify/stdin/gpgverify-test-stdin.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-stdin +Version: 1 +Release: 1 +Summary: gpgverify testcase, standard input +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests gpgverify in a pipeline where the signed data come through the +standard input stream. + +%prep +cat '%{SOURCE2}' | %{gpgverify} --keyring='%{SOURCE1}' --data=- --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/stdin/key.gpg b/tests/gpgverify/stdin/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/stdin/main.fmf b/tests/gpgverify/stdin/main.fmf new file mode 100644 index 0000000..3caad15 --- /dev/null +++ b/tests/gpgverify/stdin/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, standard input diff --git a/tests/gpgverify/test-rpmbuild b/tests/gpgverify/test-rpmbuild new file mode 100755 index 0000000..f9673ea --- /dev/null +++ b/tests/gpgverify/test-rpmbuild @@ -0,0 +1,102 @@ +#!/bin/bash + +# Distinguishing between failures and errors isn't possible in all cases, as +# RPMbuild uses exit code 1 for more than one kind of error, but this script +# still tries to make the distinction where possible. + +# Try to run the prep scriptlet of the spec found in the current directory. +# (There is one for each testcase, each in its own directory.) Save a copy of +# the output for inspection. +rpmbuild --define "_sourcedir ${PWD}" -bp *.spec 2>&1 | tee rpmbuild_output +result=${PIPESTATUS[0]} tee_result=${PIPESTATUS[1]} +if test "${test_kind}" = negative ; then + # This is a negative test. Swap the success and failure codes. Leave any + # other value as an error code. + case ${result} in + (0) + echo 'RPMbuild succeeded when it should have failed.' + exit 1 + ;; + (1) + echo 'RPMbuild failed as it should.' + result=0 + ;; + esac +fi +if test ${result} -ne 0 ; then + exit ${result} +fi + +# Any problem with tee is an error in the test. +case ${tee_result} in + (0) + # OK + ;; + (1) + exit 2 # Return error, not failure. + ;; + (*) + exit ${tee_result} + ;; +esac + +# Check whether commands after the signature verification were executed. +grep --quiet --fixed-strings 'Execution of prep continues.' rpmbuild_output +result=$? +case ${result} in + (0) + if test "${test_kind}" != negative ; then + echo 'Execution continued correctly.' + else + echo 'Execution continued when it should have stopped.' + exit 1 + fi + ;; + (1) + if test "${test_kind}" != negative ; then + echo 'Execution stopped when it should have continued.' + exit 1 + else + echo 'Execution stopped correctly.' + fi + ;; + (*) + exit ${result} # error in the test + ;; +esac + +if test -n "${required_output}" ; then + # Look for output that must be present. + grep --quiet --fixed-strings --regexp="${required_output}" rpmbuild_output + result=$? + case ${result} in + (0) + echo "The text \"${required_output}\" was correctly present." + ;; + (1) + echo "The text \"${required_output}\" didn't appear where it should." + exit 1 + ;; + (*) + exit ${result} # error in the test + ;; + esac +fi + +if test -n "${forbidden_output}" ; then + # Look for output that must be absent. + grep --quiet --fixed-strings --regexp="${forbidden_output}" rpmbuild_output + result=$? + case ${result} in + (0) + echo "The text \"${forbidden_output}\" appeared where it shouldn't." + exit 1 + ;; + (1) + echo "The text \"${forbidden_output}\" was correctly absent." + ;; + (*) + exit ${result} # error in the test + ;; + esac +fi diff --git a/tests/gpgverify/two-keys/dummy.tar.gz b/tests/gpgverify/two-keys/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/two-keys/dummy.tar.gz.sig b/tests/gpgverify/two-keys/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..3cef4c636d4a4eaaef5300c97d741f6b4d5328a8 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WT}-hsybruA(4G{>+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/two-keys/gpgverify-test-two-keys.spec b/tests/gpgverify/two-keys/gpgverify-test-two-keys.spec new file mode 100644 index 0000000..308ac26 --- /dev/null +++ b/tests/gpgverify/two-keys/gpgverify-test-two-keys.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-two-keys +Version: 1 +Release: 1 +Summary: gpgverify testcase, two separate keyrings +License: FSFAP +Source1: key-1.gpg +Source2: key-2.gpg +Source3: dummy.tar.gz +Source4: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests passing --keyring to gpgverify more than once. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --keyring='%{SOURCE2}' --data='%{SOURCE3}' --signature='%{SOURCE4}' +echo 'Execution of prep continues.' + +%changelog +* Sat Jan 11 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/two-keys/key-1.gpg b/tests/gpgverify/two-keys/key-1.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/two-keys/key-2.gpg b/tests/gpgverify/two-keys/key-2.gpg new file mode 100644 index 0000000000000000000000000000000000000000..a690910137a7b7f7f4c96eb91d3c23ea58299aab GIT binary patch literal 214 zcmbPX%#z-4rb>)cn~jl$@s>M3BO|**!HMnn!i`s@J^FLwLyRHs^Iz6}?Gd{hX5Th< z(x0}j%wr2zNosM4LUwAUf>Fn07GW_i25T`z7D=65Ocy+Yek3^gOn-OlsDgk9_jgt% zknv2?%&gp;9PCU?N=$5`T$~)-Oe|td%#2KO>`dYf3|yQ7F!i=`85wTP=6bL5^k;I- zh0D9lotaiV6MtXPv?(yH?`*|{74r3Z41YM4n$pT{Z#w=Uv~=H5MW2bk3LYFeT6}5G N{fL=Q-v0_^0|1MMQaJzs literal 0 HcmV?d00001 diff --git a/tests/gpgverify/two-keys/main.fmf b/tests/gpgverify/two-keys/main.fmf new file mode 100644 index 0000000..34fbe2b --- /dev/null +++ b/tests/gpgverify/two-keys/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, two separate keyrings diff --git a/tests/gpgverify/unarmored/dummy.tar.gz b/tests/gpgverify/unarmored/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/unarmored/dummy.tar.gz.sig b/tests/gpgverify/unarmored/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..3cef4c636d4a4eaaef5300c97d741f6b4d5328a8 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WT}-hsybruA(4G{>+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/unarmored/gpgverify-test-unarmored.spec b/tests/gpgverify/unarmored/gpgverify-test-unarmored.spec new file mode 100644 index 0000000..b4d5ecb --- /dev/null +++ b/tests/gpgverify/unarmored/gpgverify-test-unarmored.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-unarmored +Version: 1 +Release: 1 +Summary: gpgverify testcase, no ASCII armor +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests the most basic signature verification. There is no ASCII armor or +other complications. + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' +echo 'Execution of prep continues.' + +%changelog +* Fri Jan 10 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/unarmored/key.gpg b/tests/gpgverify/unarmored/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/unarmored/main.fmf b/tests/gpgverify/unarmored/main.fmf new file mode 100644 index 0000000..a805397 --- /dev/null +++ b/tests/gpgverify/unarmored/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, no ASCII armor diff --git a/tests/gpgverify/wildcard/dummy.tar.gz b/tests/gpgverify/wildcard/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..b05ec6513fae9230a390ba36f3e775e8c26c4ae6 GIT binary patch literal 327 zcmb2|=3oE==C>DP{hA#F*bC-a9+g?3bUK{>f#@EF)OMrJH)gxNwYQfa+#)4xYA2BV z=fB(xhR;)b<{c~C=WjOE{r9f8MYpd1{9Q41MOOT~>`+tJnNPe#TfJ7?D_a{rnSZUa z7hlfYpGxm{|F54C_kO?K<_|JvGdIfYSh>poef-Lzo%N#o#ax9yhphahwyYX}R)jPoBx!C%>L%YLfmk Xe?Ai=oDkr_@i+!gMd1?+8Vn2oLe`iL literal 0 HcmV?d00001 diff --git a/tests/gpgverify/wildcard/dummy.tar.gz.sig b/tests/gpgverify/wildcard/dummy.tar.gz.sig new file mode 100644 index 0000000000000000000000000000000000000000..fdfd665d5aeab94fc9bfb46c181fd4f286e83f03 GIT binary patch literal 119 zcmeAuWnmEGVvrS6WRcX_#dN_V=tqK+&-8bEI0kkMAGWWu&QIW%#GQGb!%GmgjTjDh&Rt+O{wF VVtB-av>d74WiNM&@Xxnp1^{pFG4cQa literal 0 HcmV?d00001 diff --git a/tests/gpgverify/wildcard/gpgverify-test-wildcard.spec b/tests/gpgverify/wildcard/gpgverify-test-wildcard.spec new file mode 100644 index 0000000..d077d72 --- /dev/null +++ b/tests/gpgverify/wildcard/gpgverify-test-wildcard.spec @@ -0,0 +1,21 @@ +Name: gpgverify-test-wildcard +Version: 1 +Release: 1 +Summary: gpgverify testcase, listing multiple keyrings +License: FSFAP +Source1: key-1.gpg +Source2: key-2.gpg +Source3: dummy.tar.gz +Source4: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +This tests passing multiple keyrings to gpgverify through wildcard expansion. + +%prep +%{gpgverify} --keyrings '%{_sourcedir}'/key-* --data='%{SOURCE3}' --signature='%{SOURCE4}' +echo 'Execution of prep continues.' + +%changelog +* Sat Jan 11 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/wildcard/key-1.gpg b/tests/gpgverify/wildcard/key-1.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/wildcard/key-2.gpg b/tests/gpgverify/wildcard/key-2.gpg new file mode 100644 index 0000000000000000000000000000000000000000..a690910137a7b7f7f4c96eb91d3c23ea58299aab GIT binary patch literal 214 zcmbPX%#z-4rb>)cn~jl$@s>M3BO|**!HMnn!i`s@J^FLwLyRHs^Iz6}?Gd{hX5Th< z(x0}j%wr2zNosM4LUwAUf>Fn07GW_i25T`z7D=65Ocy+Yek3^gOn-OlsDgk9_jgt% zknv2?%&gp;9PCU?N=$5`T$~)-Oe|td%#2KO>`dYf3|yQ7F!i=`85wTP=6bL5^k;I- zh0D9lotaiV6MtXPv?(yH?`*|{74r3Z41YM4n$pT{Z#w=Uv~=H5MW2bk3LYFeT6}5G N{fL=Q-v0_^0|1MMQaJzs literal 0 HcmV?d00001 diff --git a/tests/gpgverify/wildcard/main.fmf b/tests/gpgverify/wildcard/main.fmf new file mode 100644 index 0000000..178708c --- /dev/null +++ b/tests/gpgverify/wildcard/main.fmf @@ -0,0 +1 @@ +summary: gpgverify testcase, listing multiple keyrings From 61edc28275de47f029a2668411b6419aad2bfe67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Thu, 23 Jan 2025 12:25:24 +0100 Subject: [PATCH 09/19] Added a test for an attempted attack. --- .../gpgverify/invalid-parameter/dummy.tar.gz | Bin 0 -> 329 bytes .../invalid-parameter/dummy.tar.gz.sig | Bin 0 -> 119 bytes .../gpgverify-test-invalid-parameter.spec | 23 ++++++++++++++++++ tests/gpgverify/invalid-parameter/key.gpg | Bin 0 -> 214 bytes tests/gpgverify/invalid-parameter/main.fmf | 5 ++++ 5 files changed, 28 insertions(+) create mode 100644 tests/gpgverify/invalid-parameter/dummy.tar.gz create mode 100644 tests/gpgverify/invalid-parameter/dummy.tar.gz.sig create mode 100644 tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec create mode 100644 tests/gpgverify/invalid-parameter/key.gpg create mode 100644 tests/gpgverify/invalid-parameter/main.fmf diff --git a/tests/gpgverify/invalid-parameter/dummy.tar.gz b/tests/gpgverify/invalid-parameter/dummy.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..cb6bde6823f26139f9ce2c97048d7f0e438ec108 GIT binary patch literal 329 zcmb2|=3oE==C>DP^O_BK*bC-aw(?&v)VLs*5PpL-NT^NKW7Ux@kH2x}%0{S()vVz^ zMW*NTx9&af_x%s7y7~XpnJ1B9FAeo8!b9i3+pm@X`~KT!f2X?!s!dsMbe8>p&42!P z78`4oQcW}Y9{n`nvi4r5`qCoc^xm5nW-e8JKK+H;!h@N4I|GYfwM{X9dGSZ1YmeHt zjkjEyFWT^3m%it_YIe-O|5Q z%+7X6o@~|ozfO>qDZSy#X9g}#0hmb9B8Gof zXZCAWRjlMM{<w0ZY2jkcD1O^ggD%Wq2>eHWPb_0N+{4{pDV V>EG$VxOu+5!#*yF^rO5*OaLosH?9Bx literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec b/tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec new file mode 100644 index 0000000..eed1f96 --- /dev/null +++ b/tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec @@ -0,0 +1,23 @@ +Name: gpgverify-test-invalid-parameter +Version: 1 +Release: 1 +Summary: gpgverify testcase, invalid parameter +License: FSFAP +Source1: key.gpg +Source2: dummy.tar.gz +Source3: dummy.tar.gz.sig +BuildRequires: gnupg2 + +%description +Building this package shall fail because "0" is invalid as a parameter to +gpgverify. This checks that gpgverify does not have the vulnerability that an +attacker tried to inject in this merge request: +https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/84 + +%prep +%{gpgverify} --keyring='%{SOURCE1}' --data='%{SOURCE2}' --signature='%{SOURCE3}' 0 +echo 'Execution of prep continues.' + +%changelog +* Thu Jan 23 2025 Björn Persson - 1-1 +- created diff --git a/tests/gpgverify/invalid-parameter/key.gpg b/tests/gpgverify/invalid-parameter/key.gpg new file mode 100644 index 0000000000000000000000000000000000000000..028ffc96ebc06a475570b1618dcaff3bbc6d26ec GIT binary patch literal 214 zcmbPX%#z-4##xM0n~jl$@s>M3BO|**%L0}|y955sOg$E%xZ~Wd)0<~DT5_Kc>pAvz zZi{ohpV}6#lGNf7h3wQy1;dWXEW%=34Ax?bEVWWbRYwdyB(l$LeZ6$XldXFH*9o#R zfsAL8W@hE)KVvW?~UzVrFELV`ma?VBq2ufT`d0fsx@6qEcyzpxocXXKBDyN#Q MS-v?~)5C-t0E=5q$N&HU literal 0 HcmV?d00001 diff --git a/tests/gpgverify/invalid-parameter/main.fmf b/tests/gpgverify/invalid-parameter/main.fmf new file mode 100644 index 0000000..572d8fe --- /dev/null +++ b/tests/gpgverify/invalid-parameter/main.fmf @@ -0,0 +1,5 @@ +summary: gpgverify testcase, invalid parameter + +environment: + test_kind: "negative" + required_output: "gpgverify: Unknown parameter: \"0\"" From a6b58ddf41bc77d62b153d07c967364643ed25ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Thu, 10 Apr 2025 12:12:27 +0200 Subject: [PATCH 10/19] RPM macro extracted from redhat-rpm-config --- macros.gpgverify | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 macros.gpgverify diff --git a/macros.gpgverify b/macros.gpgverify new file mode 100644 index 0000000..fac0992 --- /dev/null +++ b/macros.gpgverify @@ -0,0 +1,30 @@ +# Copyright 2019 Miro Hrončok +# Copyright 2025 Björn Persson, Bjorn@Rombobeorn.se +# +# This material is provided as is, with absolutely no warranty expressed +# or implied. Any use is at your own risk. +# +# Permission is hereby granted to use or copy this program +# for any purpose, provided the above notices are retained on all copies. +# Permission to modify the code and to distribute modified code is granted, +# provided the above notices are retained, and a notice that the code was +# modified is included with the above copyright notice. + + +# gpgverify verifies signed sources. There is documentation in the script. +%gpgverify(k:s:d:) %{lua: +local script = rpm.expand("%{_libexecdir}/gpgverify ") +local keyring = rpm.expand("%{-k*}") +local signature = rpm.expand("%{-s*}") +local data = rpm.expand("%{-d*}") +print(script) +if keyring ~= "" then + print(rpm.expand("--keyring='%{SOURCE" .. keyring .. "}' ")) +end +if signature ~= "" then + print(rpm.expand("--signature='%{SOURCE" .. signature .. "}' ")) +end +if data ~= "" then + print(rpm.expand("--data='%{SOURCE" .. data .. "}' ")) +end +} From cf4ab6150af567ac969035392e214548f4159e15 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Mon, 14 Apr 2025 13:55:44 +0200 Subject: [PATCH 11/19] Adapted the testsuite to a separate package. --- .fmf/version | 1 + gating.yaml | 14 ++++++++++++++ tests/{gpgverify => }/armored/dummy.tar.gz | Bin tests/{gpgverify => }/armored/dummy.tar.gz.asc | 0 .../armored/gpgverify-test-armored.spec | 2 +- tests/{gpgverify => }/armored/key.asc | 0 tests/{gpgverify => }/armored/main.fmf | 0 tests/{gpgverify => }/bad-signer/dummy.tar.gz | Bin tests/{gpgverify => }/bad-signer/dummy.tar.gz.sig | Bin .../bad-signer/gpgverify-test-bad-signer.spec | 2 +- tests/{gpgverify => }/bad-signer/key.gpg | Bin tests/{gpgverify => }/bad-signer/main.fmf | 0 tests/{gpgverify => }/bad-tarball/dummy.tar.gz | Bin .../{gpgverify => }/bad-tarball/dummy.tar.gz.sig | Bin .../bad-tarball/gpgverify-test-bad-tarball.spec | 2 +- tests/{gpgverify => }/bad-tarball/key.gpg | Bin tests/{gpgverify => }/bad-tarball/main.fmf | 0 tests/{gpgverify => }/bad-usage/dummy.txt.asc | 0 .../bad-usage/gpgverify-test-bad-usage.spec | 2 +- tests/{gpgverify => }/bad-usage/key.gpg | Bin tests/{gpgverify => }/bad-usage/main.fmf | 0 tests/{gpgverify => }/clearsigned/dummy.txt.asc | 0 .../clearsigned/gpgverify-test-clearsigned.spec | 2 +- tests/{gpgverify => }/clearsigned/key.gpg | Bin tests/{gpgverify => }/clearsigned/main.fmf | 0 tests/{gpgverify => }/expired/dummy.tar.gz | Bin tests/{gpgverify => }/expired/dummy.tar.gz.sig | Bin .../expired/gpgverify-test-expired.spec | 2 +- tests/{gpgverify => }/expired/key.gpg | Bin tests/{gpgverify => }/expired/main.fmf | 0 .../{gpgverify => }/invalid-keyring/dummy.tar.gz | Bin .../invalid-keyring/dummy.tar.gz.sig | Bin .../gpgverify-test-invalid-keyring.spec | 2 +- tests/{gpgverify => }/invalid-keyring/key.gpg | Bin tests/{gpgverify => }/invalid-keyring/main.fmf | 0 .../invalid-parameter/dummy.tar.gz | Bin .../invalid-parameter/dummy.tar.gz.sig | Bin .../gpgverify-test-invalid-parameter.spec | 2 +- tests/{gpgverify => }/invalid-parameter/key.gpg | Bin tests/{gpgverify => }/invalid-parameter/main.fmf | 0 .../invalid-signature/dummy.tar.gz | Bin .../invalid-signature/dummy.tar.gz.sig | Bin .../gpgverify-test-invalid-signature.spec | 2 +- tests/{gpgverify => }/invalid-signature/key.gpg | Bin tests/{gpgverify => }/invalid-signature/main.fmf | 0 tests/{gpgverify => }/keybox/dummy.tar.gz | Bin tests/{gpgverify => }/keybox/dummy.tar.gz.sig | Bin .../keybox/gpgverify-test-keybox.spec | 2 +- tests/{gpgverify => }/keybox/key.kbx | Bin tests/{gpgverify => }/keybox/main.fmf | 0 tests/{gpgverify => }/main.fmf | 2 +- tests/{gpgverify => }/stdin/dummy.tar.gz | Bin tests/{gpgverify => }/stdin/dummy.tar.gz.sig | Bin .../stdin/gpgverify-test-stdin.spec | 2 +- tests/{gpgverify => }/stdin/key.gpg | Bin tests/{gpgverify => }/stdin/main.fmf | 0 tests/{gpgverify => }/test-rpmbuild | 0 tests/{gpgverify => }/two-keys/dummy.tar.gz | Bin tests/{gpgverify => }/two-keys/dummy.tar.gz.sig | Bin .../two-keys/gpgverify-test-two-keys.spec | 2 +- tests/{gpgverify => }/two-keys/key-1.gpg | Bin tests/{gpgverify => }/two-keys/key-2.gpg | Bin tests/{gpgverify => }/two-keys/main.fmf | 0 tests/{gpgverify => }/unarmored/dummy.tar.gz | Bin tests/{gpgverify => }/unarmored/dummy.tar.gz.sig | Bin .../unarmored/gpgverify-test-unarmored.spec | 2 +- tests/{gpgverify => }/unarmored/key.gpg | Bin tests/{gpgverify => }/unarmored/main.fmf | 0 tests/{gpgverify => }/wildcard/dummy.tar.gz | Bin tests/{gpgverify => }/wildcard/dummy.tar.gz.sig | Bin .../wildcard/gpgverify-test-wildcard.spec | 2 +- tests/{gpgverify => }/wildcard/key-1.gpg | Bin tests/{gpgverify => }/wildcard/key-2.gpg | Bin tests/{gpgverify => }/wildcard/main.fmf | 0 74 files changed, 30 insertions(+), 15 deletions(-) create mode 100644 .fmf/version create mode 100644 gating.yaml rename tests/{gpgverify => }/armored/dummy.tar.gz (100%) rename tests/{gpgverify => }/armored/dummy.tar.gz.asc (100%) rename tests/{gpgverify => }/armored/gpgverify-test-armored.spec (95%) rename tests/{gpgverify => }/armored/key.asc (100%) rename tests/{gpgverify => }/armored/main.fmf (100%) rename tests/{gpgverify => }/bad-signer/dummy.tar.gz (100%) rename tests/{gpgverify => }/bad-signer/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/bad-signer/gpgverify-test-bad-signer.spec (95%) rename tests/{gpgverify => }/bad-signer/key.gpg (100%) rename tests/{gpgverify => }/bad-signer/main.fmf (100%) rename tests/{gpgverify => }/bad-tarball/dummy.tar.gz (100%) rename tests/{gpgverify => }/bad-tarball/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/bad-tarball/gpgverify-test-bad-tarball.spec (95%) rename tests/{gpgverify => }/bad-tarball/key.gpg (100%) rename tests/{gpgverify => }/bad-tarball/main.fmf (100%) rename tests/{gpgverify => }/bad-usage/dummy.txt.asc (100%) rename tests/{gpgverify => }/bad-usage/gpgverify-test-bad-usage.spec (96%) rename tests/{gpgverify => }/bad-usage/key.gpg (100%) rename tests/{gpgverify => }/bad-usage/main.fmf (100%) rename tests/{gpgverify => }/clearsigned/dummy.txt.asc (100%) rename tests/{gpgverify => }/clearsigned/gpgverify-test-clearsigned.spec (96%) rename tests/{gpgverify => }/clearsigned/key.gpg (100%) rename tests/{gpgverify => }/clearsigned/main.fmf (100%) rename tests/{gpgverify => }/expired/dummy.tar.gz (100%) rename tests/{gpgverify => }/expired/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/expired/gpgverify-test-expired.spec (95%) rename tests/{gpgverify => }/expired/key.gpg (100%) rename tests/{gpgverify => }/expired/main.fmf (100%) rename tests/{gpgverify => }/invalid-keyring/dummy.tar.gz (100%) rename tests/{gpgverify => }/invalid-keyring/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/invalid-keyring/gpgverify-test-invalid-keyring.spec (95%) rename tests/{gpgverify => }/invalid-keyring/key.gpg (100%) rename tests/{gpgverify => }/invalid-keyring/main.fmf (100%) rename tests/{gpgverify => }/invalid-parameter/dummy.tar.gz (100%) rename tests/{gpgverify => }/invalid-parameter/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/invalid-parameter/gpgverify-test-invalid-parameter.spec (96%) rename tests/{gpgverify => }/invalid-parameter/key.gpg (100%) rename tests/{gpgverify => }/invalid-parameter/main.fmf (100%) rename tests/{gpgverify => }/invalid-signature/dummy.tar.gz (100%) rename tests/{gpgverify => }/invalid-signature/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/invalid-signature/gpgverify-test-invalid-signature.spec (95%) rename tests/{gpgverify => }/invalid-signature/key.gpg (100%) rename tests/{gpgverify => }/invalid-signature/main.fmf (100%) rename tests/{gpgverify => }/keybox/dummy.tar.gz (100%) rename tests/{gpgverify => }/keybox/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/keybox/gpgverify-test-keybox.spec (95%) rename tests/{gpgverify => }/keybox/key.kbx (100%) rename tests/{gpgverify => }/keybox/main.fmf (100%) rename tests/{gpgverify => }/main.fmf (94%) rename tests/{gpgverify => }/stdin/dummy.tar.gz (100%) rename tests/{gpgverify => }/stdin/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/stdin/gpgverify-test-stdin.spec (95%) rename tests/{gpgverify => }/stdin/key.gpg (100%) rename tests/{gpgverify => }/stdin/main.fmf (100%) rename tests/{gpgverify => }/test-rpmbuild (100%) rename tests/{gpgverify => }/two-keys/dummy.tar.gz (100%) rename tests/{gpgverify => }/two-keys/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/two-keys/gpgverify-test-two-keys.spec (95%) rename tests/{gpgverify => }/two-keys/key-1.gpg (100%) rename tests/{gpgverify => }/two-keys/key-2.gpg (100%) rename tests/{gpgverify => }/two-keys/main.fmf (100%) rename tests/{gpgverify => }/unarmored/dummy.tar.gz (100%) rename tests/{gpgverify => }/unarmored/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/unarmored/gpgverify-test-unarmored.spec (95%) rename tests/{gpgverify => }/unarmored/key.gpg (100%) rename tests/{gpgverify => }/unarmored/main.fmf (100%) rename tests/{gpgverify => }/wildcard/dummy.tar.gz (100%) rename tests/{gpgverify => }/wildcard/dummy.tar.gz.sig (100%) rename tests/{gpgverify => }/wildcard/gpgverify-test-wildcard.spec (95%) rename tests/{gpgverify => }/wildcard/key-1.gpg (100%) rename tests/{gpgverify => }/wildcard/key-2.gpg (100%) rename tests/{gpgverify => }/wildcard/main.fmf (100%) diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..0bd5927 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,14 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/tests/gpgverify/armored/dummy.tar.gz b/tests/armored/dummy.tar.gz similarity index 100% rename from tests/gpgverify/armored/dummy.tar.gz rename to tests/armored/dummy.tar.gz diff --git a/tests/gpgverify/armored/dummy.tar.gz.asc b/tests/armored/dummy.tar.gz.asc similarity index 100% rename from tests/gpgverify/armored/dummy.tar.gz.asc rename to tests/armored/dummy.tar.gz.asc diff --git a/tests/gpgverify/armored/gpgverify-test-armored.spec b/tests/armored/gpgverify-test-armored.spec similarity index 95% rename from tests/gpgverify/armored/gpgverify-test-armored.spec rename to tests/armored/gpgverify-test-armored.spec index 4bbdf6a..73397c6 100644 --- a/tests/gpgverify/armored/gpgverify-test-armored.spec +++ b/tests/armored/gpgverify-test-armored.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.asc Source2: dummy.tar.gz Source3: dummy.tar.gz.asc -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests signature verification where the key and the signature are ASCII- diff --git a/tests/gpgverify/armored/key.asc b/tests/armored/key.asc similarity index 100% rename from tests/gpgverify/armored/key.asc rename to tests/armored/key.asc diff --git a/tests/gpgverify/armored/main.fmf b/tests/armored/main.fmf similarity index 100% rename from tests/gpgverify/armored/main.fmf rename to tests/armored/main.fmf diff --git a/tests/gpgverify/bad-signer/dummy.tar.gz b/tests/bad-signer/dummy.tar.gz similarity index 100% rename from tests/gpgverify/bad-signer/dummy.tar.gz rename to tests/bad-signer/dummy.tar.gz diff --git a/tests/gpgverify/bad-signer/dummy.tar.gz.sig b/tests/bad-signer/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/bad-signer/dummy.tar.gz.sig rename to tests/bad-signer/dummy.tar.gz.sig diff --git a/tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec b/tests/bad-signer/gpgverify-test-bad-signer.spec similarity index 95% rename from tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec rename to tests/bad-signer/gpgverify-test-bad-signer.spec index 7033130..75d337e 100644 --- a/tests/gpgverify/bad-signer/gpgverify-test-bad-signer.spec +++ b/tests/bad-signer/gpgverify-test-bad-signer.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because the signature is made with another key. diff --git a/tests/gpgverify/bad-signer/key.gpg b/tests/bad-signer/key.gpg similarity index 100% rename from tests/gpgverify/bad-signer/key.gpg rename to tests/bad-signer/key.gpg diff --git a/tests/gpgverify/bad-signer/main.fmf b/tests/bad-signer/main.fmf similarity index 100% rename from tests/gpgverify/bad-signer/main.fmf rename to tests/bad-signer/main.fmf diff --git a/tests/gpgverify/bad-tarball/dummy.tar.gz b/tests/bad-tarball/dummy.tar.gz similarity index 100% rename from tests/gpgverify/bad-tarball/dummy.tar.gz rename to tests/bad-tarball/dummy.tar.gz diff --git a/tests/gpgverify/bad-tarball/dummy.tar.gz.sig b/tests/bad-tarball/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/bad-tarball/dummy.tar.gz.sig rename to tests/bad-tarball/dummy.tar.gz.sig diff --git a/tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec b/tests/bad-tarball/gpgverify-test-bad-tarball.spec similarity index 95% rename from tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec rename to tests/bad-tarball/gpgverify-test-bad-tarball.spec index 1635823..bf656ea 100644 --- a/tests/gpgverify/bad-tarball/gpgverify-test-bad-tarball.spec +++ b/tests/bad-tarball/gpgverify-test-bad-tarball.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because the tarball doesn't match the diff --git a/tests/gpgverify/bad-tarball/key.gpg b/tests/bad-tarball/key.gpg similarity index 100% rename from tests/gpgverify/bad-tarball/key.gpg rename to tests/bad-tarball/key.gpg diff --git a/tests/gpgverify/bad-tarball/main.fmf b/tests/bad-tarball/main.fmf similarity index 100% rename from tests/gpgverify/bad-tarball/main.fmf rename to tests/bad-tarball/main.fmf diff --git a/tests/gpgverify/bad-usage/dummy.txt.asc b/tests/bad-usage/dummy.txt.asc similarity index 100% rename from tests/gpgverify/bad-usage/dummy.txt.asc rename to tests/bad-usage/dummy.txt.asc diff --git a/tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec b/tests/bad-usage/gpgverify-test-bad-usage.spec similarity index 96% rename from tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec rename to tests/bad-usage/gpgverify-test-bad-usage.spec index 12e7138..4e80fe2 100644 --- a/tests/gpgverify/bad-usage/gpgverify-test-bad-usage.spec +++ b/tests/bad-usage/gpgverify-test-bad-usage.spec @@ -5,7 +5,7 @@ Summary: gpgverify testcase, insecure clearsigned usage License: FSFAP Source1: key.gpg Source2: dummy.txt.asc -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because it tries to verify a clearsigned text diff --git a/tests/gpgverify/bad-usage/key.gpg b/tests/bad-usage/key.gpg similarity index 100% rename from tests/gpgverify/bad-usage/key.gpg rename to tests/bad-usage/key.gpg diff --git a/tests/gpgverify/bad-usage/main.fmf b/tests/bad-usage/main.fmf similarity index 100% rename from tests/gpgverify/bad-usage/main.fmf rename to tests/bad-usage/main.fmf diff --git a/tests/gpgverify/clearsigned/dummy.txt.asc b/tests/clearsigned/dummy.txt.asc similarity index 100% rename from tests/gpgverify/clearsigned/dummy.txt.asc rename to tests/clearsigned/dummy.txt.asc diff --git a/tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec b/tests/clearsigned/gpgverify-test-clearsigned.spec similarity index 96% rename from tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec rename to tests/clearsigned/gpgverify-test-clearsigned.spec index 9b26ac9..51768b8 100644 --- a/tests/gpgverify/clearsigned/gpgverify-test-clearsigned.spec +++ b/tests/clearsigned/gpgverify-test-clearsigned.spec @@ -5,7 +5,7 @@ Summary: gpgverify testcase, clearsigned text file License: FSFAP Source1: key.gpg Source2: dummy.txt.asc -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests verifying a clearsigned text file. The clearsigned file includes diff --git a/tests/gpgverify/clearsigned/key.gpg b/tests/clearsigned/key.gpg similarity index 100% rename from tests/gpgverify/clearsigned/key.gpg rename to tests/clearsigned/key.gpg diff --git a/tests/gpgverify/clearsigned/main.fmf b/tests/clearsigned/main.fmf similarity index 100% rename from tests/gpgverify/clearsigned/main.fmf rename to tests/clearsigned/main.fmf diff --git a/tests/gpgverify/expired/dummy.tar.gz b/tests/expired/dummy.tar.gz similarity index 100% rename from tests/gpgverify/expired/dummy.tar.gz rename to tests/expired/dummy.tar.gz diff --git a/tests/gpgverify/expired/dummy.tar.gz.sig b/tests/expired/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/expired/dummy.tar.gz.sig rename to tests/expired/dummy.tar.gz.sig diff --git a/tests/gpgverify/expired/gpgverify-test-expired.spec b/tests/expired/gpgverify-test-expired.spec similarity index 95% rename from tests/gpgverify/expired/gpgverify-test-expired.spec rename to tests/expired/gpgverify-test-expired.spec index d85b075..bc12a47 100644 --- a/tests/gpgverify/expired/gpgverify-test-expired.spec +++ b/tests/expired/gpgverify-test-expired.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests signature verification with an expired key. Rebuilds shall not fail diff --git a/tests/gpgverify/expired/key.gpg b/tests/expired/key.gpg similarity index 100% rename from tests/gpgverify/expired/key.gpg rename to tests/expired/key.gpg diff --git a/tests/gpgverify/expired/main.fmf b/tests/expired/main.fmf similarity index 100% rename from tests/gpgverify/expired/main.fmf rename to tests/expired/main.fmf diff --git a/tests/gpgverify/invalid-keyring/dummy.tar.gz b/tests/invalid-keyring/dummy.tar.gz similarity index 100% rename from tests/gpgverify/invalid-keyring/dummy.tar.gz rename to tests/invalid-keyring/dummy.tar.gz diff --git a/tests/gpgverify/invalid-keyring/dummy.tar.gz.sig b/tests/invalid-keyring/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/invalid-keyring/dummy.tar.gz.sig rename to tests/invalid-keyring/dummy.tar.gz.sig diff --git a/tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec b/tests/invalid-keyring/gpgverify-test-invalid-keyring.spec similarity index 95% rename from tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec rename to tests/invalid-keyring/gpgverify-test-invalid-keyring.spec index 91ca978..fb8d653 100644 --- a/tests/gpgverify/invalid-keyring/gpgverify-test-invalid-keyring.spec +++ b/tests/invalid-keyring/gpgverify-test-invalid-keyring.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because the keyring is invalid. diff --git a/tests/gpgverify/invalid-keyring/key.gpg b/tests/invalid-keyring/key.gpg similarity index 100% rename from tests/gpgverify/invalid-keyring/key.gpg rename to tests/invalid-keyring/key.gpg diff --git a/tests/gpgverify/invalid-keyring/main.fmf b/tests/invalid-keyring/main.fmf similarity index 100% rename from tests/gpgverify/invalid-keyring/main.fmf rename to tests/invalid-keyring/main.fmf diff --git a/tests/gpgverify/invalid-parameter/dummy.tar.gz b/tests/invalid-parameter/dummy.tar.gz similarity index 100% rename from tests/gpgverify/invalid-parameter/dummy.tar.gz rename to tests/invalid-parameter/dummy.tar.gz diff --git a/tests/gpgverify/invalid-parameter/dummy.tar.gz.sig b/tests/invalid-parameter/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/invalid-parameter/dummy.tar.gz.sig rename to tests/invalid-parameter/dummy.tar.gz.sig diff --git a/tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec b/tests/invalid-parameter/gpgverify-test-invalid-parameter.spec similarity index 96% rename from tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec rename to tests/invalid-parameter/gpgverify-test-invalid-parameter.spec index eed1f96..5c343b5 100644 --- a/tests/gpgverify/invalid-parameter/gpgverify-test-invalid-parameter.spec +++ b/tests/invalid-parameter/gpgverify-test-invalid-parameter.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because "0" is invalid as a parameter to diff --git a/tests/gpgverify/invalid-parameter/key.gpg b/tests/invalid-parameter/key.gpg similarity index 100% rename from tests/gpgverify/invalid-parameter/key.gpg rename to tests/invalid-parameter/key.gpg diff --git a/tests/gpgverify/invalid-parameter/main.fmf b/tests/invalid-parameter/main.fmf similarity index 100% rename from tests/gpgverify/invalid-parameter/main.fmf rename to tests/invalid-parameter/main.fmf diff --git a/tests/gpgverify/invalid-signature/dummy.tar.gz b/tests/invalid-signature/dummy.tar.gz similarity index 100% rename from tests/gpgverify/invalid-signature/dummy.tar.gz rename to tests/invalid-signature/dummy.tar.gz diff --git a/tests/gpgverify/invalid-signature/dummy.tar.gz.sig b/tests/invalid-signature/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/invalid-signature/dummy.tar.gz.sig rename to tests/invalid-signature/dummy.tar.gz.sig diff --git a/tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec b/tests/invalid-signature/gpgverify-test-invalid-signature.spec similarity index 95% rename from tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec rename to tests/invalid-signature/gpgverify-test-invalid-signature.spec index c1171aa..21cb09a 100644 --- a/tests/gpgverify/invalid-signature/gpgverify-test-invalid-signature.spec +++ b/tests/invalid-signature/gpgverify-test-invalid-signature.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description Building this package shall fail because the signature is invalid. diff --git a/tests/gpgverify/invalid-signature/key.gpg b/tests/invalid-signature/key.gpg similarity index 100% rename from tests/gpgverify/invalid-signature/key.gpg rename to tests/invalid-signature/key.gpg diff --git a/tests/gpgverify/invalid-signature/main.fmf b/tests/invalid-signature/main.fmf similarity index 100% rename from tests/gpgverify/invalid-signature/main.fmf rename to tests/invalid-signature/main.fmf diff --git a/tests/gpgverify/keybox/dummy.tar.gz b/tests/keybox/dummy.tar.gz similarity index 100% rename from tests/gpgverify/keybox/dummy.tar.gz rename to tests/keybox/dummy.tar.gz diff --git a/tests/gpgverify/keybox/dummy.tar.gz.sig b/tests/keybox/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/keybox/dummy.tar.gz.sig rename to tests/keybox/dummy.tar.gz.sig diff --git a/tests/gpgverify/keybox/gpgverify-test-keybox.spec b/tests/keybox/gpgverify-test-keybox.spec similarity index 95% rename from tests/gpgverify/keybox/gpgverify-test-keybox.spec rename to tests/keybox/gpgverify-test-keybox.spec index e7dc906..2999c28 100644 --- a/tests/gpgverify/keybox/gpgverify-test-keybox.spec +++ b/tests/keybox/gpgverify-test-keybox.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.kbx Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests signature verification with a key in the keybox format. diff --git a/tests/gpgverify/keybox/key.kbx b/tests/keybox/key.kbx similarity index 100% rename from tests/gpgverify/keybox/key.kbx rename to tests/keybox/key.kbx diff --git a/tests/gpgverify/keybox/main.fmf b/tests/keybox/main.fmf similarity index 100% rename from tests/gpgverify/keybox/main.fmf rename to tests/keybox/main.fmf diff --git a/tests/gpgverify/main.fmf b/tests/main.fmf similarity index 94% rename from tests/gpgverify/main.fmf rename to tests/main.fmf index 1a1d514..36fe2ef 100644 --- a/tests/gpgverify/main.fmf +++ b/tests/main.fmf @@ -3,7 +3,7 @@ require: - rpm-build - - gnupg2 + - gpgverify - grep test: ../test-rpmbuild diff --git a/tests/gpgverify/stdin/dummy.tar.gz b/tests/stdin/dummy.tar.gz similarity index 100% rename from tests/gpgverify/stdin/dummy.tar.gz rename to tests/stdin/dummy.tar.gz diff --git a/tests/gpgverify/stdin/dummy.tar.gz.sig b/tests/stdin/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/stdin/dummy.tar.gz.sig rename to tests/stdin/dummy.tar.gz.sig diff --git a/tests/gpgverify/stdin/gpgverify-test-stdin.spec b/tests/stdin/gpgverify-test-stdin.spec similarity index 95% rename from tests/gpgverify/stdin/gpgverify-test-stdin.spec rename to tests/stdin/gpgverify-test-stdin.spec index a04dc15..42d1b72 100644 --- a/tests/gpgverify/stdin/gpgverify-test-stdin.spec +++ b/tests/stdin/gpgverify-test-stdin.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests gpgverify in a pipeline where the signed data come through the diff --git a/tests/gpgverify/stdin/key.gpg b/tests/stdin/key.gpg similarity index 100% rename from tests/gpgverify/stdin/key.gpg rename to tests/stdin/key.gpg diff --git a/tests/gpgverify/stdin/main.fmf b/tests/stdin/main.fmf similarity index 100% rename from tests/gpgverify/stdin/main.fmf rename to tests/stdin/main.fmf diff --git a/tests/gpgverify/test-rpmbuild b/tests/test-rpmbuild similarity index 100% rename from tests/gpgverify/test-rpmbuild rename to tests/test-rpmbuild diff --git a/tests/gpgverify/two-keys/dummy.tar.gz b/tests/two-keys/dummy.tar.gz similarity index 100% rename from tests/gpgverify/two-keys/dummy.tar.gz rename to tests/two-keys/dummy.tar.gz diff --git a/tests/gpgverify/two-keys/dummy.tar.gz.sig b/tests/two-keys/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/two-keys/dummy.tar.gz.sig rename to tests/two-keys/dummy.tar.gz.sig diff --git a/tests/gpgverify/two-keys/gpgverify-test-two-keys.spec b/tests/two-keys/gpgverify-test-two-keys.spec similarity index 95% rename from tests/gpgverify/two-keys/gpgverify-test-two-keys.spec rename to tests/two-keys/gpgverify-test-two-keys.spec index 308ac26..06a9c64 100644 --- a/tests/gpgverify/two-keys/gpgverify-test-two-keys.spec +++ b/tests/two-keys/gpgverify-test-two-keys.spec @@ -7,7 +7,7 @@ Source1: key-1.gpg Source2: key-2.gpg Source3: dummy.tar.gz Source4: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests passing --keyring to gpgverify more than once. diff --git a/tests/gpgverify/two-keys/key-1.gpg b/tests/two-keys/key-1.gpg similarity index 100% rename from tests/gpgverify/two-keys/key-1.gpg rename to tests/two-keys/key-1.gpg diff --git a/tests/gpgverify/two-keys/key-2.gpg b/tests/two-keys/key-2.gpg similarity index 100% rename from tests/gpgverify/two-keys/key-2.gpg rename to tests/two-keys/key-2.gpg diff --git a/tests/gpgverify/two-keys/main.fmf b/tests/two-keys/main.fmf similarity index 100% rename from tests/gpgverify/two-keys/main.fmf rename to tests/two-keys/main.fmf diff --git a/tests/gpgverify/unarmored/dummy.tar.gz b/tests/unarmored/dummy.tar.gz similarity index 100% rename from tests/gpgverify/unarmored/dummy.tar.gz rename to tests/unarmored/dummy.tar.gz diff --git a/tests/gpgverify/unarmored/dummy.tar.gz.sig b/tests/unarmored/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/unarmored/dummy.tar.gz.sig rename to tests/unarmored/dummy.tar.gz.sig diff --git a/tests/gpgverify/unarmored/gpgverify-test-unarmored.spec b/tests/unarmored/gpgverify-test-unarmored.spec similarity index 95% rename from tests/gpgverify/unarmored/gpgverify-test-unarmored.spec rename to tests/unarmored/gpgverify-test-unarmored.spec index b4d5ecb..71f401e 100644 --- a/tests/gpgverify/unarmored/gpgverify-test-unarmored.spec +++ b/tests/unarmored/gpgverify-test-unarmored.spec @@ -6,7 +6,7 @@ License: FSFAP Source1: key.gpg Source2: dummy.tar.gz Source3: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests the most basic signature verification. There is no ASCII armor or diff --git a/tests/gpgverify/unarmored/key.gpg b/tests/unarmored/key.gpg similarity index 100% rename from tests/gpgverify/unarmored/key.gpg rename to tests/unarmored/key.gpg diff --git a/tests/gpgverify/unarmored/main.fmf b/tests/unarmored/main.fmf similarity index 100% rename from tests/gpgverify/unarmored/main.fmf rename to tests/unarmored/main.fmf diff --git a/tests/gpgverify/wildcard/dummy.tar.gz b/tests/wildcard/dummy.tar.gz similarity index 100% rename from tests/gpgverify/wildcard/dummy.tar.gz rename to tests/wildcard/dummy.tar.gz diff --git a/tests/gpgverify/wildcard/dummy.tar.gz.sig b/tests/wildcard/dummy.tar.gz.sig similarity index 100% rename from tests/gpgverify/wildcard/dummy.tar.gz.sig rename to tests/wildcard/dummy.tar.gz.sig diff --git a/tests/gpgverify/wildcard/gpgverify-test-wildcard.spec b/tests/wildcard/gpgverify-test-wildcard.spec similarity index 95% rename from tests/gpgverify/wildcard/gpgverify-test-wildcard.spec rename to tests/wildcard/gpgverify-test-wildcard.spec index d077d72..80c44d3 100644 --- a/tests/gpgverify/wildcard/gpgverify-test-wildcard.spec +++ b/tests/wildcard/gpgverify-test-wildcard.spec @@ -7,7 +7,7 @@ Source1: key-1.gpg Source2: key-2.gpg Source3: dummy.tar.gz Source4: dummy.tar.gz.sig -BuildRequires: gnupg2 +BuildRequires: gpgverify %description This tests passing multiple keyrings to gpgverify through wildcard expansion. diff --git a/tests/gpgverify/wildcard/key-1.gpg b/tests/wildcard/key-1.gpg similarity index 100% rename from tests/gpgverify/wildcard/key-1.gpg rename to tests/wildcard/key-1.gpg diff --git a/tests/gpgverify/wildcard/key-2.gpg b/tests/wildcard/key-2.gpg similarity index 100% rename from tests/gpgverify/wildcard/key-2.gpg rename to tests/wildcard/key-2.gpg diff --git a/tests/gpgverify/wildcard/main.fmf b/tests/wildcard/main.fmf similarity index 100% rename from tests/gpgverify/wildcard/main.fmf rename to tests/wildcard/main.fmf From 8a352b62246c9403089472891dcdb25b966df7b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Wed, 7 May 2025 08:57:01 +0200 Subject: [PATCH 12/19] Added a separate license file. --- license.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 license.txt diff --git a/license.txt b/license.txt new file mode 100644 index 0000000..c461e69 --- /dev/null +++ b/license.txt @@ -0,0 +1,12 @@ +Copyright 2018 – 2024 B. Persson, Bjorn@Rombobeorn.se + +This material is provided as is, with absolutely no warranty expressed +or implied. Any use is at your own risk. + +Permission is hereby granted to use or copy this program +for any purpose, provided the above notices are retained on all copies. +Permission to modify the code and to distribute modified code is granted, +provided the above notices are retained, and a notice that the code was +modified is included with the above copyright notice. + +A few files have other copyright holders. From 7353bd98ed2c3c350548c5dd41fc8d13de5f7a01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Thu, 8 May 2025 10:31:36 +0200 Subject: [PATCH 13/19] hardened against garbage in the environment --- gpgverify | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gpgverify b/gpgverify index 9fc01f9..def86ef 100755 --- a/gpgverify +++ b/gpgverify @@ -85,7 +85,7 @@ function check_status { # Parse the command line. keyring_parameters=false -declare -a keyrings +keyrings=() # empty array signature= data= output= @@ -156,6 +156,7 @@ workdir="$(mktemp --directory)" check_status 'Making a temporary directory' $? # Decode any ASCII armor on the keyrings. +keyring_params=() # empty array number=1 for keyring in "${keyrings[@]}" ; do if grep --quiet '^-----BEGIN PGP PUBLIC KEY BLOCK-----' "${keyring}" ; then From 8b06edee2b2614609df897c8bdc7dd5e7b468854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Thu, 8 May 2025 11:10:53 +0200 Subject: [PATCH 14/19] Added the spec. --- README.md | 3 --- gpgverify.spec | 42 ++++++++++++++++++++++++++++++++++++++++++ sources | 0 3 files changed, 42 insertions(+), 3 deletions(-) delete mode 100644 README.md create mode 100644 gpgverify.spec create mode 100644 sources diff --git a/README.md b/README.md deleted file mode 100644 index d04ca61..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# gpgverify - -The gpgverify package diff --git a/gpgverify.spec b/gpgverify.spec new file mode 100644 index 0000000..7180516 --- /dev/null +++ b/gpgverify.spec @@ -0,0 +1,42 @@ +Name: gpgverify +Version: 2.1 +Release: 2%{?dist} +Summary: Signature verifier for easy and safe scripting + +License: Boehm-GC +URL: https://src.fedoraproject.org/rpms/gpgverify +Source: gpgverify +Source: macros.gpgverify +Source: license.txt +BuildArch: noarch + +Requires: grep gnupg2 + +%description +GPGverify is a wrapper around GnuPG's gpgv. It verifies a file against an +OpenPGP signature and one or more keyrings. Rather than assuming manual use by +a knowledgeable user, GPGverify is designed to be easy to use safely in a +script. It avoids various unsafe ways of using gpgv that could make a script +vulnerable. + +%prep +# Enable use of filenames instead of source numbers. +%setup -c -T +cp --preserve=timestamps %{sources} . + +%install +mkdir --parents %{buildroot}%{rpmmacrodir} %{buildroot}%{_libexecdir} +cp --preserve=timestamps gpgverify %{buildroot}%{_libexecdir}/ +cp --preserve=timestamps macros.gpgverify %{buildroot}%{rpmmacrodir}/ + +%files +%attr(0755,-,-) %{_libexecdir}/gpgverify +%attr(0644,-,-) %{rpmmacrodir}/macros.gpgverify +%license license.txt + +%changelog +* Wed May 07 2025 Björn Persson - 2.1-2 +- Added a separate license file. + +* Mon Apr 14 2025 Björn Persson - 2.1-1 +- GPGverify has been split out from redhat-rpm-config. diff --git a/sources b/sources new file mode 100644 index 0000000..e69de29 From 0bae065caab4952a17efcaf6da7773ed5e5661e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Fri, 9 May 2025 08:15:40 +0200 Subject: [PATCH 15/19] Added testsuite.fmf. --- testsuite.fmf | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 testsuite.fmf diff --git a/testsuite.fmf b/testsuite.fmf new file mode 100644 index 0000000..462146d --- /dev/null +++ b/testsuite.fmf @@ -0,0 +1,8 @@ +# Something in the testing machinery demands a "plan", and it must be kept +# separate from the testcases, so here's a file that makes two defaults +# explicit. + +discover: + how: fmf +execute: + how: tmt From b13478256c29869503a92b1c66b24c7865b23cd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Fri, 9 May 2025 09:12:46 +0200 Subject: [PATCH 16/19] Rebuilt to retry the testsuite. --- gpgverify.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gpgverify.spec b/gpgverify.spec index 7180516..7e35234 100644 --- a/gpgverify.spec +++ b/gpgverify.spec @@ -1,6 +1,6 @@ Name: gpgverify Version: 2.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Signature verifier for easy and safe scripting License: Boehm-GC @@ -35,6 +35,9 @@ cp --preserve=timestamps macros.gpgverify %{buildroot}%{rpmmacrodir}/ %license license.txt %changelog +* Fri May 09 2025 Björn Persson - 2.1-3 +- Rebuilt to retry the testsuite. + * Wed May 07 2025 Björn Persson - 2.1-2 - Added a separate license file. From 34fbd33fed5af31d49ced34cde47a109758317ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Fri, 27 Jun 2025 19:54:26 +0200 Subject: [PATCH 17/19] Evaluate _libexecdir at build time. --- gpgverify.spec | 18 ++++++++++++++---- macros.gpgverify => macros.gpgverify.in | 2 +- 2 files changed, 15 insertions(+), 5 deletions(-) rename macros.gpgverify => macros.gpgverify.in (94%) diff --git a/gpgverify.spec b/gpgverify.spec index 7e35234..5b8e26f 100644 --- a/gpgverify.spec +++ b/gpgverify.spec @@ -1,12 +1,12 @@ Name: gpgverify -Version: 2.1 -Release: 3%{?dist} +Version: 2.2 +Release: 1%{?dist} Summary: Signature verifier for easy and safe scripting License: Boehm-GC URL: https://src.fedoraproject.org/rpms/gpgverify Source: gpgverify -Source: macros.gpgverify +Source: macros.gpgverify.in Source: license.txt BuildArch: noarch @@ -24,10 +24,16 @@ vulnerable. %setup -c -T cp --preserve=timestamps %{sources} . +%conf +# Convey the location of the shellscript to macros.gpgverify. To keep build +# dependencies minimal, do substitution in Bash instead of something like Sed. +macrofile=$(macros.gpgverify + %install mkdir --parents %{buildroot}%{rpmmacrodir} %{buildroot}%{_libexecdir} cp --preserve=timestamps gpgverify %{buildroot}%{_libexecdir}/ -cp --preserve=timestamps macros.gpgverify %{buildroot}%{rpmmacrodir}/ +cp macros.gpgverify %{buildroot}%{rpmmacrodir}/ %files %attr(0755,-,-) %{_libexecdir}/gpgverify @@ -35,6 +41,10 @@ cp --preserve=timestamps macros.gpgverify %{buildroot}%{rpmmacrodir}/ %license license.txt %changelog +* Fri Jun 27 2025 Björn Persson - 2.2-1 +- Evaluate _libexecdir at build time, not at run time (reported by Yaakov + Selkowitz). + * Fri May 09 2025 Björn Persson - 2.1-3 - Rebuilt to retry the testsuite. diff --git a/macros.gpgverify b/macros.gpgverify.in similarity index 94% rename from macros.gpgverify rename to macros.gpgverify.in index fac0992..20c78e0 100644 --- a/macros.gpgverify +++ b/macros.gpgverify.in @@ -13,7 +13,7 @@ # gpgverify verifies signed sources. There is documentation in the script. %gpgverify(k:s:d:) %{lua: -local script = rpm.expand("%{_libexecdir}/gpgverify ") +local script = rpm.expand("@libexecdir@/gpgverify ") local keyring = rpm.expand("%{-k*}") local signature = rpm.expand("%{-s*}") local data = rpm.expand("%{-d*}") From 54ea2c342c3caade7d5c547773c6b74ef5a695b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Persson?= Date: Tue, 15 Jul 2025 12:59:26 +0200 Subject: [PATCH 18/19] Adapted the dependencies because the gnupg2 package has been split. --- gpgverify.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/gpgverify.spec b/gpgverify.spec index 5b8e26f..475e28a 100644 --- a/gpgverify.spec +++ b/gpgverify.spec @@ -1,6 +1,6 @@ Name: gpgverify Version: 2.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Signature verifier for easy and safe scripting License: Boehm-GC @@ -10,7 +10,7 @@ Source: macros.gpgverify.in Source: license.txt BuildArch: noarch -Requires: grep gnupg2 +Requires: grep gnupg2 gnupg2-verify %description GPGverify is a wrapper around GnuPG's gpgv. It verifies a file against an @@ -41,6 +41,9 @@ cp macros.gpgverify %{buildroot}%{rpmmacrodir}/ %license license.txt %changelog +* Tue Jul 15 2025 Björn Persson - 2.2-2 +- Adapted the dependencies because the gnupg2 package has been split. + * Fri Jun 27 2025 Björn Persson - 2.2-1 - Evaluate _libexecdir at build time, not at run time (reported by Yaakov Selkowitz). From 296714a0a9113a38983ee490740b63c2b7b8d4a6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 16:28:37 +0000 Subject: [PATCH 19/19] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- gpgverify.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gpgverify.spec b/gpgverify.spec index 475e28a..9a567a4 100644 --- a/gpgverify.spec +++ b/gpgverify.spec @@ -1,6 +1,6 @@ Name: gpgverify Version: 2.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Signature verifier for easy and safe scripting License: Boehm-GC @@ -41,6 +41,9 @@ cp macros.gpgverify %{buildroot}%{rpmmacrodir}/ %license license.txt %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 2.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jul 15 2025 Björn Persson - 2.2-2 - Adapted the dependencies because the gnupg2 package has been split.