The VALIDSIG status line from GnuPG with --status-fd has a field that
specifies the fingerprint of the primary key that made the signature.
However, that field is only available for OpenPGP signatures; not for
CMS/X.509.
An unbounded search for a non-existent primary key fingerprint for X509
signatures results in the following status line being interpreted as the
fingerprint.
Signed-off-by: Hans Jerry Illikainen <hji@xxxxxxxxxxxx>
---
gpg-interface.c | 20 +++++++++++++++-----
t/t4202-log.sh | 6 ++++++
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/gpg-interface.c b/gpg-interface.c
index d60115ca40..01c7ef42d4 100644
--- a/gpg-interface.c
+++ b/gpg-interface.c
@@ -148,21 +148,31 @@ static void parse_gpg_output(struct signature_check *sigc)
}
/* Do we have fingerprint? */
if (sigcheck_gpg_status[i].flags & GPG_STATUS_FINGERPRINT) {
+ const char *limit;
+
next = strchrnul(line, ' ');
free(sigc->fingerprint);
sigc->fingerprint = xmemdupz(line, next - line);
- /* Skip interim fields */
+ /* Skip interim fields. The search is
+ * limited to the same line since only
+ * OpenPGP signatures has a field with
+ * the primary fingerprint. */
+ limit = strchrnul(line, '\n');
for (j = 9; j > 0; j--) {
- if (!*next)
+ if (!*next || next >= limit)
break;
line = next + 1;
next = strchrnul(line, ' ');
}
- next = strchrnul(line, '\n');
- free(sigc->primary_key_fingerprint);
- sigc->primary_key_fingerprint = xmemdupz(line, next - line);
+ if (j == 0) {
+ next = strchrnul(line, '\n');
+ free(sigc->primary_key_fingerprint);
+ sigc->primary_key_fingerprint =
+ xmemdupz(line,
+ next - line);
+ }
}
break;
diff --git a/t/t4202-log.sh b/t/t4202-log.sh
index e803ba402e..5d893b3137 100755
--- a/t/t4202-log.sh
+++ b/t/t4202-log.sh
@@ -1580,6 +1580,12 @@ test_expect_success GPGSM 'setup signed branch x509' '
git commit -S -m signed_commit
'
+test_expect_success GPGSM 'log x509 fingerprint' '
+ echo "F8BF62E0693D0694816377099909C779FA23FD65 | " >expect &&
+ git log -n1 --format="%GF | %GP" signed-x509 >actual &&
+ test_cmp expect actual
+'
+
test_expect_success GPG 'log --graph --show-signature' '
git log --graph --show-signature -n1 signed >actual &&
grep "^| gpg: Signature made" actual &&
--
2.24.0.156.g69483321b9.dirty
