Skip to content

Commit bd9abd8

Browse files
committed
removes insecure DSA keys from signature test
Signed-off-by: Ricardo Bartels <ricardo.bartels@telekom.de>
1 parent c261da5 commit bd9abd8

File tree

6 files changed

+45
-120
lines changed

6 files changed

+45
-120
lines changed

git/signatures/gpg_signature_test.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,6 @@ func TestVerifyPGPSignatureForCommitsAndTags(t *testing.T) {
208208
{"ecdsa_p256 valid signature", "commit_ecdsa_p256_signed.txt", "tag_ecdsa_p256_signed.txt", "key_ecdsa_p256.pub", false},
209209
{"ecdsa_p384 valid signature", "commit_ecdsa_p384_signed.txt", "tag_ecdsa_p384_signed.txt", "key_ecdsa_p384.pub", false},
210210
{"ecdsa_p521 valid signature", "commit_ecdsa_p521_signed.txt", "tag_ecdsa_p521_signed.txt", "key_ecdsa_p521.pub", false},
211-
{"dsa_2048 valid signature", "commit_dsa_2048_signed.txt", "tag_dsa_2048_signed.txt", "key_dsa_2048.pub", false},
212211
{"brainpool_p256 valid signature", "commit_brainpool_p256_signed.txt", "tag_brainpool_p256_signed.txt", "key_brainpool_p256.pub", false},
213212
{"brainpool_p384 valid signature", "commit_brainpool_p384_signed.txt", "tag_brainpool_p384_signed.txt", "key_brainpool_p384.pub", false},
214213
{"brainpool_p512 valid signature", "commit_brainpool_p512_signed.txt", "tag_brainpool_p512_signed.txt", "key_brainpool_p512.pub", false},

git/signatures/testdata/gpg_signatures/README.md

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ The [`generate_gpg_fixtures.sh`](generate_gpg_fixtures.sh) script automates the
2020

2121
1. **GPG Key Pairs** in supported variants:
2222
- RSA (2048 and 4096 bits)
23-
- DSA (2048 bits)
2423
- ECC/ECDSA (NIST P-256, P-384, P-521)
2524
- Brainpool curves (P-256, P-384, P-512)
2625
- EdDSA (Ed25519, Ed448)
@@ -81,18 +80,6 @@ Expire-Date: 0
8180
EOF
8281
gpg --batch --generate-key batch_rsa_4096.txt
8382

84-
# DSA 2048-bit key
85-
cat > batch_dsa_2048.txt <<EOF
86-
%no-protection
87-
Key-Type: DSA
88-
Key-Length: 2048
89-
Name-Real: Test User
90-
Name-Email: test-dsa-2048@example.com
91-
Expire-Date: 0
92-
%commit
93-
EOF
94-
gpg --batch --generate-key batch_dsa_2048.txt
95-
9683
# ECDSA P-256 key
9784
cat > batch_ecdsa_p256.txt <<EOF
9885
%no-protection
@@ -192,7 +179,6 @@ gpg --batch --generate-key batch_ed448.txt
192179
# Export public keys
193180
gpg --armor --export test-rsa-2048@example.com > key_rsa_2048.pub
194181
gpg --armor --export test-rsa-4096@example.com > key_rsa_4096.pub
195-
gpg --armor --export test-dsa-2048@example.com > key_dsa_2048.pub
196182
gpg --armor --export test-ecdsa-p256@example.com > key_ecdsa_p256.pub
197183
gpg --armor --export test-ecdsa-p384@example.com > key_ecdsa_p384.pub
198184
gpg --armor --export test-ecdsa-p521@example.com > key_ecdsa_p521.pub
@@ -284,7 +270,6 @@ The script generates the following files:
284270
### Public Keys
285271
- `key_rsa_2048.pub` - RSA 2048-bit public key
286272
- `key_rsa_4096.pub` - RSA 4096-bit public key
287-
- `key_dsa_2048.pub` - DSA 2048-bit public key
288273
- `key_ecdsa_p256.pub` - ECDSA P-256 public key
289274
- `key_ecdsa_p384.pub` - ECDSA P-384 public key
290275
- `key_ecdsa_p521.pub` - ECDSA P-521 public key
@@ -297,7 +282,6 @@ The script generates the following files:
297282
### Signed Commits
298283
- `commit_rsa_2048_signed.txt` - RSA 2048-bit signed commit
299284
- `commit_rsa_4096_signed.txt` - RSA 4096-bit signed commit
300-
- `commit_dsa_2048_signed.txt` - DSA 2048-bit signed commit
301285
- `commit_ecdsa_p256_signed.txt` - ECDSA P-256 signed commit
302286
- `commit_ecdsa_p384_signed.txt` - ECDSA P-384 signed commit
303287
- `commit_ecdsa_p521_signed.txt` - ECDSA P-521 signed commit
@@ -310,7 +294,6 @@ The script generates the following files:
310294
### Signed Tags
311295
- `tag_rsa_2048_signed.txt` - RSA 2048-bit signed tag
312296
- `tag_rsa_4096_signed.txt` - RSA 4096-bit signed tag
313-
- `tag_dsa_2048_signed.txt` - DSA 2048-bit signed tag
314297
- `tag_ecdsa_p256_signed.txt` - ECDSA P-256 signed tag
315298
- `tag_ecdsa_p384_signed.txt` - ECDSA P-384 signed tag
316299
- `tag_ecdsa_p521_signed.txt` - ECDSA P-521 signed tag
@@ -330,10 +313,6 @@ The script generates the following files:
330313
- **RSA 4096**: Stronger RSA key with 4096-bit modulus
331314
- Widely supported, but slower than ECC keys
332315

333-
### DSA (Digital Signature Algorithm)
334-
- **DSA 2048**: Legacy algorithm, 2048-bit key
335-
- Less secure than modern alternatives, included for compatibility testing
336-
337316
### ECDSA (Elliptic Curve Digital Signature Algorithm)
338317
- **P-256**: NIST P-256 curve (secp256r1)
339318
- **P-384**: NIST P-384 curve (secp384r1)
@@ -385,7 +364,7 @@ If key generation fails, ensure that:
385364

386365
### Script structure
387366
The script uses separate functions for different key types:
388-
- `generate_rsa_dsa_key()` - For RSA and DSA keys with key length validation
367+
- `generate_rsa_dsa_key()` - For RSA keys with key length validation
389368
- `generate_ecc_key()` - For ECC/ECDSA/EdDSA keys with curve validation
390369
- `create_signed_object()` - For creating signed commits and tags
391370
- `create_unsigned_commit()` - For creating unsigned test commits

git/signatures/testdata/gpg_signatures/commit_dsa_2048_signed.txt

Lines changed: 0 additions & 12 deletions
This file was deleted.

git/signatures/testdata/gpg_signatures/generate_gpg_fixtures.sh

Lines changed: 44 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -31,52 +31,52 @@ generate_key() {
3131
local key_type=$1
3232
local key_param=$2
3333
local key_name=$3
34-
34+
3535
echo "Generating $key_type key pair ($key_name)..."
36-
36+
3737
# Create batch configuration for GPG
3838
local batch_file="$TEMP_DIR/batch_${key_name}.txt"
3939
cat > "$batch_file" <<EOF
4040
%no-protection
4141
Key-Type: $key_type
4242
EOF
43-
43+
4444
# Add key-specific parameters
4545
case "$key_type" in
46-
RSA|DSA)
46+
RSA)
4747
echo "Key-Length: $key_param" >> "$batch_file"
4848
;;
4949
ecdsa|eddsa)
5050
echo "Key-Curve: $key_param" >> "$batch_file"
5151
;;
5252
esac
53-
53+
5454
cat >> "$batch_file" <<EOF
5555
Name-Real: $TEST_USER_NAME
5656
Name-Email: test-${key_name}@example.com
5757
Expire-Date: 0
5858
%commit
5959
EOF
60-
60+
6161
# Generate the key
6262
gpg --batch --generate-key "$batch_file" 2>&1
63-
63+
6464
# Get the key ID
6565
local key_id
6666
key_id=$(gpg --list-keys --with-colons "test-${key_name}@example.com" | grep '^fpr' | head -1 | cut -d: -f10)
67-
67+
6868
echo " Key ID: $key_id"
69-
69+
7070
# Export public key
7171
gpg --armor --export "test-${key_name}@example.com" > "$SCRIPT_DIR/key_${key_name}.pub"
7272
echo " ✓ key_${key_name}.pub created"
73-
73+
7474
# Export secret key (for signing)
7575
gpg --armor --export-secret-keys "test-${key_name}@example.com" > "$TEMP_DIR/${key_name}.sec"
76-
76+
7777
# Store key ID for later use
7878
echo "$key_id" > "$TEMP_DIR/${key_name}_id.txt"
79-
79+
8080
rm -f "$batch_file"
8181
echo "$key_name key pair generated successfully"
8282
}
@@ -85,41 +85,41 @@ EOF
8585
create_signed_object() {
8686
local object_type=$1
8787
local key_name=$2
88-
88+
8989
echo "Creating signed $object_type for $key_name..."
90-
90+
9191
# Get key ID
9292
local key_id
9393
key_id=$(cat "$TEMP_DIR/${key_name}_id.txt")
94-
94+
9595
# Create temporary Git repository
9696
local repo_dir="$TEMP_DIR/repo_${key_name}_${object_type}"
9797
mkdir -p "$repo_dir"
9898
cd "$repo_dir"
99-
99+
100100
git init
101101
git config user.name "$TEST_USER_NAME"
102102
git config user.email "$TEST_USER_EMAIL"
103103
git config gpg.program gpg
104104
git config user.signingkey "$key_id"
105-
105+
106106
# Import the secret key for signing
107107
gpg --batch --import "$TEMP_DIR/${key_name}.sec" 2>/dev/null
108-
108+
109109
# Create file and commit
110110
echo "Test content for $key_name $object_type" > test.txt
111111
git add test.txt
112112
git commit -m "Test commit for $object_type"
113-
113+
114114
if [[ "$object_type" == "commit" ]]; then
115115
# Sign the commit (amend)
116116
git commit --amend --allow-empty -S -m "Test commit signed with $key_name"
117-
117+
118118
# Verify the signed commit
119119
echo " Verifying signed commit..."
120120
git verify-commit HEAD 2>&1 | grep -q "Good signature"
121121
echo " ✓ Commit signature verified successfully"
122-
122+
123123
# Export commit object
124124
git cat-file commit HEAD > "$SCRIPT_DIR/commit_${key_name}_signed.txt"
125125
cd "$SCRIPT_DIR"
@@ -128,12 +128,12 @@ create_signed_object() {
128128
elif [[ "$object_type" == "tag" ]]; then
129129
# Create and sign tag
130130
git tag -a "test-tag-${key_name}" -m "Test tag signed with $key_name" -s
131-
131+
132132
# Verify the signed tag
133133
echo " Verifying signed tag..."
134134
git verify-tag "test-tag-${key_name}" 2>&1 | grep -q "Good signature"
135135
echo " ✓ Tag signature verified successfully"
136-
136+
137137
# Export tag object
138138
git cat-file tag "test-tag-${key_name}" > "$SCRIPT_DIR/tag_${key_name}_signed.txt"
139139
cd "$SCRIPT_DIR"
@@ -144,64 +144,61 @@ create_signed_object() {
144144
# Function to create unsigned commit
145145
create_unsigned_commit() {
146146
echo "Creating unsigned commit..."
147-
147+
148148
# Create temporary Git repository
149149
local repo_dir="$TEMP_DIR/repo_unsigned"
150150
mkdir -p "$repo_dir"
151151
cd "$repo_dir"
152-
152+
153153
git init
154154
git config user.name "$TEST_USER_NAME"
155155
git config user.email "$TEST_USER_EMAIL"
156-
156+
157157
# Create file and commit (without signature)
158158
echo "Test content unsigned" > test.txt
159159
git add test.txt
160160
git commit -m "Test commit unsigned"
161-
161+
162162
# Export commit object
163163
git cat-file commit HEAD > "$SCRIPT_DIR/commit_unsigned.txt"
164-
164+
165165
cd "$SCRIPT_DIR"
166166
echo " ✓ commit_unsigned.txt created"
167167
}
168168

169169
# Main program
170170
main() {
171-
echo "Step 1: Generate RSA/DSA keys..."
171+
echo "Step 1: Generate RSA keys..."
172172
echo "-----------------------------------"
173-
173+
174174
# RSA keys (different key lengths)
175175
generate_key "RSA" "2048" "rsa_2048"
176176
generate_key "RSA" "4096" "rsa_4096"
177-
178-
# DSA key (legacy, but still supported)
179-
generate_key "DSA" "2048" "dsa_2048"
180-
177+
181178
echo ""
182179
echo "Step 2: Generate ECC keys..."
183180
echo "-----------------------------------"
184-
181+
185182
# ECDSA keys (different curves)
186183
generate_key "ecdsa" "NIST P-256" "ecdsa_p256"
187184
generate_key "ecdsa" "NIST P-384" "ecdsa_p384"
188185
generate_key "ecdsa" "NIST P-521" "ecdsa_p521"
189-
186+
190187
# Brainpool curves
191188
generate_key "ecdsa" "brainpoolP256r1" "brainpool_p256"
192189
generate_key "ecdsa" "brainpoolP384r1" "brainpool_p384"
193190
generate_key "ecdsa" "brainpoolP512r1" "brainpool_p512"
194-
191+
195192
# Ed25519 (modern elliptic curve)
196193
generate_key "eddsa" "Ed25519" "ed25519"
197-
194+
198195
# Ed448 (less common)
199196
generate_key "eddsa" "Ed448" "ed448"
200-
197+
201198
echo ""
202199
echo "Step 3: Create signed commits..."
203200
echo "----------------------------------------"
204-
201+
205202
# Get list of successfully generated keys
206203
local keys=() key_name=""
207204
for key_file in "$TEMP_DIR"/*_id.txt; do
@@ -210,32 +207,32 @@ main() {
210207
keys+=("$key_name")
211208
fi
212209
done
213-
210+
214211
# Signed commits for each key type
215212
for key_name in "${keys[@]}"; do
216213
create_signed_object "commit" "$key_name"
217214
done
218-
215+
219216
echo ""
220217
echo "Step 4: Create signed tags..."
221218
echo "-------------------------------------"
222-
219+
223220
# Signed tags for each key type
224221
for key_name in "${keys[@]}"; do
225222
create_signed_object "tag" "$key_name"
226223
done
227-
224+
228225
echo ""
229226
echo "Step 5: Create unsigned commit..."
230227
echo "------------------------------------------"
231-
228+
232229
create_unsigned_commit
233-
230+
234231
echo ""
235232
echo "=== Cleanup ==="
236233
rm -rf "$TEMP_DIR"
237234
echo "Temporary directory removed"
238-
235+
239236
echo ""
240237
echo "=== Done! ==="
241238
echo "All test fixtures have been successfully created."

git/signatures/testdata/gpg_signatures/key_dsa_2048.pub

Lines changed: 0 additions & 25 deletions
This file was deleted.

git/signatures/testdata/gpg_signatures/tag_dsa_2048_signed.txt

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)