From eda8a84fa695800290a97fd45e88ecc29d32317d Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 13:31:20 -1000 Subject: Test serving a snapshot signature No test fetched a signature within the size limit, so the status, the headers that keep a browser from sniffing it and the body went unchecked, as did the answer for a ref with none and the plain tar signature a compressed tar falls back to. --- tests/t0110-snapshot.sh | 84 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 61 insertions(+), 23 deletions(-) diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh index 125cb7f..6d59686 100755 --- a/tests/t0110-snapshot.sh +++ b/tests/t0110-snapshot.sh @@ -5,8 +5,8 @@ # pipes through a compressor, and each compressed format needs the same tool # on the server and here, so one missing tool skips that format on both # grounds at once. The rest covers how a snapshot is named and found again from -# its name, with a repository of its own for each set of refs, and the -# requests that are refused. +# its name, with a repository of its own for each set of refs, the signatures +# kept in notes, and the requests that are refused. test_description='Verify snapshot' . ./setup.sh @@ -335,32 +335,70 @@ test_expect_success 'a snapshot name leads to the tag ahead of a branch' ' test "$commit" = "$want" ' -# A signature is a note a pusher stored, held to max-blob-size like any blob. -test_expect_success 'a signature past max-blob-size is refused' ' - big=$(test_seq 1 2000 | git -C repos/vtags hash-object -w --stdin) && - git -C repos/vtags notes --ref signatures/tar.gz add -C $big v1.0 && - { - echo "max-blob-size=1" && - cat vtagsrc - } >sigrc && - cgit_rc sigrc "url=vtags/snapshot/vtags-1.0.tar.gz.asc" >tmp && - grep "^Status: 413" tmp -' - -test_expect_success 'a snapshot and its signature are linked as one unit' ' +# A signature is a note a pusher stored against the commit, served as it is +# under headers that keep a browser from taking it for anything else, and held +# to max-blob-size like any blob. A compressed tar with no signature of its +# own offers the one made for the plain tar it expands to. +test_expect_success 'set up a repo with signed snapshots' ' test_create_repo repos/signed && ( cd repos/signed && - echo one >file && - git add file && - git commit -m one && - git tag one && - sig=$(echo signature | git hash-object -w --stdin) && - git notes --ref signatures/tar.gz add -C $sig one + for tag in one two three big + do + git commit --allow-empty -m $tag && + git tag $tag || return 1 + done && + echo signature >sig && + sig=$(git hash-object -w sig) && + git notes --ref signatures/tar.gz add -C $sig one && + echo plain >plain && + plain=$(git hash-object -w plain) && + git notes --ref signatures/tar add -C $plain three && + big=$(test_seq 1 2000 | git hash-object -w --stdin) && + git notes --ref signatures/tar.gz add -C $big big ) && - cgitrc_repo signedrc signed snapshots=tar.gz && - cgit_rc signedrc "url=signed/refs/" >tmp && + cgitrc_repo signedrc signed snapshots=tar.gz +' + +test_expect_success 'a snapshot and its signature are linked as one unit' ' + cgit_ok signedrc "url=signed/refs/" >tmp && grep "signed-one.tar.gz (sig)" tmp ' +test_expect_success 'a signature is served as the note holds it' ' + cgit_ok signedrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp && + sed "/^$/q" tmp >headers && + grep "^Content-Type: application/pgp-signature$" headers && + grep "^Content-Disposition: inline; filename=\"signed-one.tar.gz.asc\"$" headers && + grep "^X-Content-Type-Options: nosniff$" headers && + grep "^Content-Security-Policy: default-src .none.$" headers && + strip_headers actual && + echo signature >expect && + test_cmp expect actual +' + +test_expect_success 'a ref with no signature has none to offer' ' + cgit_ok signedrc "url=signed/refs/" >tmp && + grep "signed-two.tar.gz" tmp && + cgit_rc signedrc "url=signed/snapshot/signed-two.tar.gz.asc" >tmp && + grep "^Status: 404" tmp && + grep "
No signature for signed-two.tar.gz
" tmp +' + +test_expect_success 'a compressed tar offers the plain tar signature' ' + cgit_ok signedrc "url=signed/refs/" >tmp && + grep "signed-three.tar.gz (sig)" tmp && + cgit_ok signedrc "url=signed/snapshot/signed-three.tar.asc" >tmp && + strip_headers actual && + echo plain >expect && + test_cmp expect actual +' + +test_expect_success 'a signature past max-blob-size is refused' ' + cgitrc_repo sigrc signed snapshots=tar.gz max-blob-size=1 && + cgit_rc sigrc "url=signed/snapshot/signed-big.tar.gz.asc" >tmp && + grep "^Status: 413" tmp && + cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp +' + test_done -- cgit 2.12.1