Skip to content
Snippets Groups Projects

GPG signed commits

Merged Alexis Reigel requested to merge siemens/gitlab-ce:feature/gpg-signed-commits into master
2 files
+ 23
14
Compare changes
  • Side-by-side
  • Inline
Files
2
+ 17
8
@@ -19,6 +19,19 @@ def signature
cached_signature = GpgSignature.find_by(commit_sha: commit.sha)
return cached_signature if cached_signature.present?
using_keychain do |gpg_key|
if gpg_key
Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
@verified_signature = nil
end
create_cached_signature!(gpg_key)
end
end
private
def using_keychain
Gitlab::Gpg.using_tmp_keychain do
# first we need to get the keyid from the signature to query the gpg
# key belonging to the keyid.
@@ -30,27 +43,23 @@ def signature
Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
end
create_cached_signature!(gpg_key)
yield gpg_key
end
end
private
def verified_signature
GPGME::Crypto.new.verify(@signature_text, signed_text: @signed_text) do |verified_signature|
@verified_signature ||= GPGME::Crypto.new.verify(@signature_text, signed_text: @signed_text) do |verified_signature|
return verified_signature
end
end
def create_cached_signature!(gpg_key)
verified_signature_result = verified_signature
GpgSignature.create!(
commit_sha: commit.sha,
project: commit.project,
gpg_key: gpg_key,
gpg_key_primary_keyid: gpg_key&.primary_keyid || verified_signature_result.fingerprint,
valid_signature: !!(gpg_key && gpg_key.verified? && verified_signature_result.valid?)
gpg_key_primary_keyid: gpg_key&.primary_keyid || verified_signature.fingerprint,
valid_signature: !!(gpg_key && gpg_key.verified? && verified_signature.valid?)
)
end
end
Loading