tix signature verification

crate-status.md

@@ -98,7 +98,7 @@ The top-level crate that acts as hub to all functionality provided by the `gix-*
         * [x] use credential helper configuration and to obtain credentials with `gix_credentials::helper::Cascade`
     * **traverse**
         * [x] commit graphs
-        * [ ] make [git-notes](https://git-scm.com/docs/git-notes) accessible
+        * [x] make [git-notes](https://git-scm.com/docs/git-notes) accessible
         * [x] tree entries
     * **diffs/changes**
         * [x] tree with other tree
@@ -619,7 +619,7 @@ Provide a native SSH transport and authentication backend so `gix` users can shi
 
 A mechanism to associate metadata with any object, and keep revisions of it using git itself.
 
-* [ ] CRUD for git notes
+* [x] CRUD for git notes
 
 ### gix-negotiate
 * **algorithms**

gitoxide-core/Cargo.toml

@@ -49,7 +49,7 @@ serde = ["gix/serde", "dep:serde_json", "dep:serde", "bytesize/serde"]
 
 [dependencies]
 # deselect everything else (like "performance") as this should be controllable by the parent application.
-gix = { version = "^0.86.0", path = "../gix", default-features = false, features = ["merge", "blob-diff", "blame", "revision", "mailmap", "excludes", "attributes", "worktree-mutation", "credentials", "interrupt", "status", "dirwalk"] }
+gix = { version = "^0.86.0", path = "../gix", default-features = false, features = ["merge", "blob-diff", "blame", "revision", "mailmap", "excludes", "attributes", "worktree-mutation", "credentials", "interrupt", "status", "dirwalk", "command"] }
 gix-pack-for-configuration-only = { package = "gix-pack", version = "^0.73.0", path = "../gix-pack", default-features = false, features = ["pack-cache-lru-dynamic", "pack-cache-lru-static", "generate", "streaming-input"] }
 gix-transport-configuration-only = { package = "gix-transport", version = "^0.58.1", path = "../gix-transport", default-features = false }
 gix-archive-for-configuration-only = { package = "gix-archive", version = "^0.35.0", path = "../gix-archive", optional = true, features = ["tar", "tar_gz"] }

gitoxide-core/src/repository/commit.rs

@@ -19,30 +19,13 @@ pub fn verify(repo: gix::Repository, rev_spec: Option<&str>) -> Result<()> {
         .rev_parse_single(format!("{rev_spec}^{{commit}}").as_str())?
         .object()?
         .into_commit();
-    let (signature, signed_data) = commit
-        .signature()
-        .context("Could not parse commit to obtain signature")?
+    let outcome = commit
+        .verify_signature()
+        .context("Could not verify commit signature")?
         .ok_or_else(|| anyhow!("Commit at {rev_spec} is not signed"))?;
-
-    let mut signature_storage = tempfile::NamedTempFile::new()?;
-    signature_storage.write_all(signature.as_ref())?;
-    let signed_storage = signature_storage.into_temp_path();
-
-    let mut cmd: std::process::Command = gix::command::prepare("gpg").into();
-    cmd.args(["--keyid-format=long", "--status-fd=1", "--verify"])
-        .arg(&signed_storage)
-        .arg("-")
-        .stdin(Stdio::piped());
-    gix::trace::debug!("About to execute {cmd:?}");
-    let mut child = cmd.spawn()?;
-    child
-        .stdin
-        .take()
-        .expect("configured")
-        .write_all(signed_data.to_bstring().as_ref())?;
-
-    if !child.wait()?.success() {
-        bail!("Command {cmd:?} failed");
+    std::io::stderr().write_all(&outcome.output)?;
+    if !outcome.is_valid() {
+        bail!("Commit at {rev_spec} has an invalid or untrusted signature");
     }
     Ok(())
 }

gix-diff/src/blob/platform.rs

@@ -537,6 +537,7 @@ impl Platform {
             .resources()
             .ok_or(prepare_diff_command::Error::SourceOrDestinationUnset)?;
         let mut cmd: std::process::Command = gix_command::prepare(gix_path::from_bstring(diff_command))
+            .command_may_be_shell_script_disallow_manual_argument_splitting()
             .with_context(context)
             .env("GIT_DIFF_PATH_COUNTER", (count + 1).to_string())
             .env("GIT_DIFF_PATH_TOTAL", total.to_string())

gix-diff/tests/diff/blob/platform.rs

@@ -88,6 +88,14 @@ fn resources_of_worktree_and_odb_and_check_link() -> crate::Result {
         "in this case, there is no rename-to field as last argument, it's based on the resource paths being different"
     );
 
+    let command = platform.prepare_diff_command("test --flag".into(), Default::default(), 0, 1)?;
+    assert!(
+        command
+            .get_args()
+            .any(|arg| arg.to_string_lossy().contains("test --flag")),
+        "configured command lines with arguments are interpreted by a shell"
+    );
+
     platform.set_resource(id, EntryKind::Link, "a".into(), ResourceKind::NewOrDestination, &db)?;
 
     // Double-inserts are fine.

gix-note/Cargo.toml

@@ -14,4 +14,17 @@ include = ["/src/**/*", "/LICENSE-*"]
 [lib]
 doctest = false
 
+[features]
+## Enable support for the SHA-1 hash by forwarding it to dependencies.
+sha1 = ["gix-hash/sha1", "gix-object/sha1"]
+## Enable support for the SHA-256 hash by forwarding it to dependencies.
+sha256 = ["gix-hash/sha256", "gix-object/sha256"]
+
 [dependencies]
+gix-error = { version = "^0.2.5", path = "../gix-error" }
+gix-hash = { version = "^0.26.0", path = "../gix-hash" }
+gix-object = { version = "^0.63.0", path = "../gix-object" }
+
+[dev-dependencies]
+gix-odb = { path = "../gix-odb" }
+gix-testtools = { path = "../tests/tools" }