Reject line breaks in RSL entry ref names and upstream repository fields
on write. Restrict Person custom metadata keys to a conservative
character set.
Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Restructure storage so gittuf verification can run over backends other
than the git binary (e.g. go-git):
- pkg/githash: concrete Git object hash, stdlib-only.
gitinterface.Hash aliases it.
- pkg/gitstore: the single Storer interface (24 methods) that all
storage consumers program against, plus the shared
ErrReferenceNotFound sentinel. *gitinterface.Repository satisfies it
structurally (compile-time asserted). Also defines ConfigKey, the
canonical type for the Git config settings gittuf reads.
- pkg/rsl (from internal/rsl): entry model, codec, and readers over
gitstore.Storer; zero gitinterface/sigstore dependencies. rsl.Hash
aliases githash.Hash; nil is the unset-Hash sentinel and IsZero
matches nil and empty as well as both format zeros (no
object-format-unaware ZeroHash). Entry commits (empty tree on the
RSL ref) are owned by the package; no storer adapter.
- internal/signerverifier/gitobject: verifies commit/tag signatures
over (payload, signature) bytes, Rekor URL as an option. The storage
half is Repository.GetObjectSignature. Removes sigstore, cosign, and
gitsign from gitinterface's dependency tree.
- internal/propagation: propagation workflow, moved off pkg/rsl's
public API (its tuf directive types are internal).
- internal/{attestations,cache,policy}: storage via gitstore.Storer;
tree writing via WriteTree(blobs, subtrees).
Breaking changes to pkg/gitinterface: Repository.VerifySignature and
the verification sentinels are removed (use gitobject.Verify);
ErrReferenceNotFound now aliases gitstore's. Repository.GetGitConfig
(which returned the whole config map) is replaced by
LookupConfig(gitstore.ConfigKey), returning a single setting's value.
Policy resolves the Rekor override from git config once per
verification and extracts signed payloads once per object instead of
per key attempt.
Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
Make gittuf hash-algorithm aware so it operates on SHA-256 repositories:
- gitinterface.Repository detects its object format (via
`git rev-parse --show-object-format`) and exposes GetObjectFormat and a
per-repo ZeroHash. GetReference returns the format-appropriate zero hash
so ref updates to new refs succeed in SHA-256 repositories.
- Commit and tag signing/verification use the `gpgsig-sha256` header for
SHA-256 objects (go-git's SignatureSHA256), matching Git's behavior. The
verification field is chosen by the object's OID length. Fixes verify-ref
failing on Git-signed SHA-256 RSL entries.
- git-remote-gittuf negotiates object-format from the repository instead of
hardcoding sha1, and uses the repo-appropriate zero hash for ref tips.
- Test helpers can create SHA-256 repositories; gitinterface, rsl, policy,
and experimental/gittuf suites now run under both formats, plus an
end-to-end Git-signed record+verify test.
Assisted-by: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Paulo Gomes <paulo@entire.io>
TestCanSign/explicit_ssh,_no_key sets gpg.format=ssh in a temp repo and
expects CanSign() to fail because no user.signingkey is set. On a host
with user.signingkey in ~/.gitconfig, the temp repo inherits the key via
scoped config and the test passes CanSign() unexpectedly.
The existing comment at the top of TestCanSign acknowledges this and
skips the assertion as a result. Point GIT_CONFIG_GLOBAL and
GIT_CONFIG_SYSTEM at /dev/null for the duration of the test instead, so
all subtests can run regardless of the host's signing config.
Signed-off-by: Andrew Nesbitt <andrewnez@gmail.com>
LoadRepository did os.Chdir(repositoryPath) to run 'git rev-parse
--git-dir', and Status/RestoreWorktree/tree-restore did the same to run
worktree-relative commands. os.Chdir is process-global; concurrent
LoadRepository calls for different paths could each resolve the wrong
gitDirPath.
Adds executor.withDir(dir) which sets cmd.Dir. LoadRepository now runs
'git rev-parse --absolute-git-dir' with cmd.Dir set to the repository
path (and EvalSymlinks the result to match prior behaviour). The
worktree commands use withDir(worktree).
TestLoadRepositoryConcurrent runs 20 pairs of LoadRepository for two
distinct repos in parallel under -race and asserts each gets its own
gitDirPath.
Signed-off-by: Andrew Nesbitt <andrewnez@gmail.com>
GetGoGitRepository was passing DetectDotGit:true to PlainOpenWithOptions
on a path that is already the resolved git directory (set from
'git rev-parse --git-dir' in LoadRepository). With detect on, go-git
looks for a .git entry inside that path; a bare repository has none, so
it returns ErrRepositoryNotExists and every caller (verifyCommitSignature,
tag verification) fails on bare repos.
DetectDotGit:false treats the path as the git dir directly and opens
both bare and working-tree layouts.
Adds tests covering GetGoGitRepository on bare repos including the
forge-conventional <name>.git layout.
Signed-off-by: Andrew Nesbitt <andrewnez@gmail.com>
This commit adds tests for uncovered error paths and edge cases in
pkg/gitinterface, and refactors existing tests for clarity:
- Add error path tests for CheckAndSetReference, SetReference,
DeleteReference, RefSpec, CanSign, VerifySignature,
TagUsingSpecificKey, GetAllFilesInTree, EnsureIsCommit,
GetTagTarget, ensureIsTag, and other helpers
- Inline error-case test functions into parent tests using t.Run
subtests for better organization
- Extract inline byte slices into named variables for readability
- Simplify temp directory usage where subdirectories are unnecessary
- Remove redundant parser-level error tests
- Format files with gofmt
Signed-off-by: dawgdevv <nraj02415@gmail.com>
This PR adds focused tests for error paths and edge cases across
pkg/gitinterface, raising coverage from 69.4% to 76.2%.
Files changed:
- references_test.go: TestAbsoluteReference with branch/tag/custom/ref lookups
- tag_test.go: TestEnsureIsTag, error paths for GetTagTarget and verifyTagSignature
- commit_test.go: TestEnsureIsCommit, error paths for commit inspection helpers
- object_test.go: Error paths for GetObjectType and GetObjectSize
- blob_test.go: Error path for ReadBlob with non-blob object
- status_test.go: Tests for Status errors and StatusCode helpers
- sync_test.go: Tests for WithFetchDepth, CreateRemote, push/fetch errors
- config_test.go: Error path for SetGitConfig
- utils_test.go: TestResetDueToError
Closes#1244
Signed-off-by: dawgdevv <nraj02415@gmail.com>
