diff --git a/Makefile-ostree.am b/Makefile-ostree.am index 95cf6779..1bdc5f34 100644 --- a/Makefile-ostree.am +++ b/Makefile-ostree.am @@ -29,6 +29,7 @@ ostree_SOURCES = src/ostree/main.c \ src/ostree/ot-builtin-commit.c \ src/ostree/ot-builtin-diff.c \ src/ostree/ot-builtin-fsck.c \ + src/ostree/ot-builtin-gpg-sign.c \ src/ostree/ot-builtin-init.c \ src/ostree/ot-builtin-pull-local.c \ src/ostree/ot-builtin-log.c \ diff --git a/doc/Makefile.am b/doc/Makefile.am index 5e5e3867..453551c6 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -125,7 +125,7 @@ version.xml: # This includes the standard gtk-doc make rules, copied by gtkdocize. include $(top_srcdir)/gtk-doc.make -man1_MANS = ostree.1 ostree-admin-cleanup.1 ostree-admin-config-diff.1 ostree-admin-deploy.1 ostree-admin-init-fs.1 ostree-admin-instutil.1 ostree-admin-os-init.1 ostree-admin-status.1 ostree-admin-set-origin.1 ostree-admin-switch.1 ostree-admin-undeploy.1 ostree-admin-upgrade.1 ostree-admin.1 ostree-cat.1 ostree-checkout.1 ostree-checksum.1 ostree-commit.1 ostree-config.1 ostree-diff.1 ostree-fsck.1 ostree-init.1 ostree-log.1 ostree-ls.1 ostree-prune.1 ostree-pull-local.1 ostree-pull.1 ostree-refs.1 ostree-remote.1 ostree-reset.1 ostree-rev-parse.1 ostree-show.1 ostree-summary.1 ostree-static-delta.1 ostree-trivial-httpd.1 +man1_MANS = ostree.1 ostree-admin-cleanup.1 ostree-admin-config-diff.1 ostree-admin-deploy.1 ostree-admin-init-fs.1 ostree-admin-instutil.1 ostree-admin-os-init.1 ostree-admin-status.1 ostree-admin-set-origin.1 ostree-admin-switch.1 ostree-admin-undeploy.1 ostree-admin-upgrade.1 ostree-admin.1 ostree-cat.1 ostree-checkout.1 ostree-checksum.1 ostree-commit.1 ostree-gpg-sign.1 ostree-config.1 ostree-diff.1 ostree-fsck.1 ostree-init.1 ostree-log.1 ostree-ls.1 ostree-prune.1 ostree-pull-local.1 ostree-pull.1 ostree-refs.1 ostree-remote.1 ostree-reset.1 ostree-rev-parse.1 ostree-show.1 ostree-summary.1 ostree-static-delta.1 ostree-trivial-httpd.1 man5_MANS = ostree.repo.5 ostree.repo-config.5 diff --git a/doc/ostree-gpg-sign.xml b/doc/ostree-gpg-sign.xml new file mode 100644 index 00000000..0c7ab7d4 --- /dev/null +++ b/doc/ostree-gpg-sign.xml @@ -0,0 +1,80 @@ + + + + + + + + + ostree gpg-sign + OSTree + + + + Developer + Colin + Walters + walters@verbum.org + + + + + + ostree gpg-sign + 1 + + + + ostree-gpg-sign + Sign a commit + + + + + ostree gpg-sign OPTIONS COMMIT KEY-ID + + + + + Description + + + Add a new signature to a commit for each specified GPG key. + + Note that currently, this will append a new signature even if + the commit is already signed with a given key. + + + + + Options + + + + ="HOMEDIR" + + + GPG Homedir to use when looking for keyrings. + + + + + diff --git a/src/ostree/main.c b/src/ostree/main.c index b8dccd6b..93656fd4 100644 --- a/src/ostree/main.c +++ b/src/ostree/main.c @@ -41,6 +41,9 @@ static OstreeCommand commands[] = { { "config", ostree_builtin_config }, { "diff", ostree_builtin_diff }, { "fsck", ostree_builtin_fsck }, +#ifdef HAVE_GPGME + { "gpg-sign", ostree_builtin_gpg_sign }, +#endif { "init", ostree_builtin_init }, { "log", ostree_builtin_log }, { "ls", ostree_builtin_ls }, diff --git a/src/ostree/ot-builtin-gpg-sign.c b/src/ostree/ot-builtin-gpg-sign.c new file mode 100644 index 00000000..74354d03 --- /dev/null +++ b/src/ostree/ot-builtin-gpg-sign.c @@ -0,0 +1,94 @@ +/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- + * + * Copyright (C) 2015 Colin Walters + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the + * Free Software Foundation, Inc., 59 Temple Place - Suite 330, + * Boston, MA 02111-1307, USA. + * + * Author: Colin Walters + */ + +#include "config.h" + +#include "ot-main.h" +#include "ot-builtins.h" +#include "ostree.h" +#include "otutil.h" + +static char *opt_gpg_homedir; + +static GOptionEntry options[] = { + { "gpg-homedir", 0, 0, G_OPTION_ARG_STRING, &opt_gpg_homedir, "GPG Homedir to use when looking for keyrings", "HOMEDIR"}, +}; + +static void +usage_error (GOptionContext *context, const char *message, GError **error) +{ + gs_free char *help = g_option_context_get_help (context, TRUE, NULL); + g_printerr ("%s", help); + g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_FAILED, message); +} + +gboolean +ostree_builtin_gpg_sign (int argc, char **argv, GCancellable *cancellable, GError **error) +{ + GOptionContext *context; + gs_unref_object OstreeRepo *repo = NULL; + gs_free char *resolved_commit = NULL; + const char *commit; + char **key_ids; + int n_key_ids, ii; + gboolean ret = FALSE; + + context = g_option_context_new ("COMMIT KEY-ID... - Sign a commit"); + + if (!ostree_option_context_parse (context, options, &argc, &argv, OSTREE_BUILTIN_FLAG_NONE, &repo, cancellable, error)) + goto out; + + if (argc < 2) + { + usage_error (context, "Need a COMMIT to sign", error); + goto out; + } + + if (argc < 3) + { + usage_error (context, "Need at least one GPG KEY-ID to sign with", error); + goto out; + } + + commit = argv[1]; + key_ids = argv + 2; + n_key_ids = argc - 2; + + if (!ostree_repo_resolve_rev (repo, commit, FALSE, &resolved_commit, error)) + goto out; + + for (ii = 0; ii < n_key_ids; ii++) + { + if (!ostree_repo_sign_commit (repo, resolved_commit, key_ids[ii], + opt_gpg_homedir, cancellable, error)) + goto out; + } + + ret = TRUE; + +out: + if (context) + g_option_context_free (context); + + return ret; +} + diff --git a/src/ostree/ot-builtins.h b/src/ostree/ot-builtins.h index 099b2bc4..95262ec4 100644 --- a/src/ostree/ot-builtins.h +++ b/src/ostree/ot-builtins.h @@ -35,6 +35,7 @@ BUILTINPROTO(checkout); BUILTINPROTO(checksum); BUILTINPROTO(commit); BUILTINPROTO(diff); +BUILTINPROTO(gpg_sign); BUILTINPROTO(init); BUILTINPROTO(log); BUILTINPROTO(pull); diff --git a/tests/test-gpg-signed-commit.sh b/tests/test-gpg-signed-commit.sh index 8a75660a..a3d1ad37 100644 --- a/tests/test-gpg-signed-commit.sh +++ b/tests/test-gpg-signed-commit.sh @@ -39,3 +39,11 @@ cd ${test_tmpdir} ${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" --gpg-sign=${TEST_GPG_KEYID} --gpg-sign=${TEST_GPG_KEYID} --gpg-sign=${TEST_GPG_KEYID} --gpg-homedir=${TEST_GPG_KEYHOME} --tree=dir=files $OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 > test2-gpgsigs assert_file_has_content test2-gpgsigs 'byte ' + +# Commit and sign separately +cd ${test_tmpdir} +${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" --tree=dir=files +$OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 2> /dev/null && (echo 1>&2 "unsigned commit unexpectedly had detached metadata"; exit 1) +$OSTREE gpg-sign test2 ${TEST_GPG_KEYID} --gpg-homedir=${TEST_GPG_KEYHOME} +$OSTREE show --print-detached-metadata-key=ostree.gpgsigs test2 > test2-gpgsigs +assert_file_has_content test2-gpgsigs 'byte '