Archived
5
2
Fork
You've already forked git-sig
1

incorrect check_tools() logic and gpg command variable use #5

Open
opened 2023年05月31日 15:15:55 +02:00 by cr-tk · 0 comments

While following up on the failing Outputs advice to install missing gpg test, I noticed that the test correctly identifies misbehaving code.

Test output:

not ok 5 Outputs advice to install missing gpg
# (in test file sig/test/test.bats, line 31)
# `echo "${output}" | grep "apt install gpg"' failed

There are multiple problems:

Line 101 in 03bbbcc
command -v "1ドル" >/dev/null || die "Error: $cmd not found"

incorrectly checks against 1ドル instead of the $cmd within the loop. As a result, all checks are against git, not against the actual $cmd binaries.

The last commit 03bbbcc350 generalized the gpg command name by switching to GIT_SIG_GPG_VERIFY_COMMAND and GIT_SIG_SIGN_COMMAND. However, the code then uses GIT_SIG_VERIFY_COMMAND in multiple places, which does not exist (note the missing _GPG substring). This leads to the check_tools git head cut find sort sed getopt openssl call which does not check for gpg.
Note that other commands are affected by this as well.

If gpg is missing from $PATH, as the test simulates, the program will exit 1 on

Line 101 in 03bbbcc
command -v "1ドル" >/dev/null || die "Error: $cmd not found"

instead of calling die_pkg() which gives the command installation recommendation that the test is looking for. die_pkg() is called in check_version(), which runs only if the target command is available for a version check.

While following up on the failing `Outputs advice to install missing gpg` test, I noticed that the test correctly identifies misbehaving code. Test output: ``` not ok 5 Outputs advice to install missing gpg # (in test file sig/test/test.bats, line 31) # `echo "${output}" | grep "apt install gpg"' failed ``` There are multiple problems: https://codeberg.org/distrust/git-sig/src/commit/03bbbcc350177fe359892d70789e0c8a60bd30dd/git-sig#L101 incorrectly checks against `1ドル` instead of the `$cmd` within the loop. As a result, all checks are against `git`, not against the actual `$cmd` binaries. The last commit 03bbbcc350177fe359892d70789e0c8a60bd30dd generalized the gpg command name by switching to GIT_SIG_GPG_VERIFY_COMMAND` and GIT_SIG_SIGN_COMMAND`. However, the code then uses `GIT_SIG_VERIFY_COMMAND` in multiple places, which does not exist (note the missing `_GPG` substring). This leads to the `check_tools git head cut find sort sed getopt openssl` call which does not check for `gpg`. Note that other commands are affected by this as well. If gpg is missing from $PATH, as the test simulates, the program will `exit 1` on https://codeberg.org/distrust/git-sig/src/commit/03bbbcc350177fe359892d70789e0c8a60bd30dd/git-sig#L101 instead of calling `die_pkg()` which gives the command installation recommendation that the test is looking for. `die_pkg()` is called in `check_version()`, which runs only if the target command is available for a version check.
Commenting is not possible because the repository is archived.
No Branch/Tag specified
master
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
distrust/git-sig#5
Reference in a new issue
distrust/git-sig
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?