(List
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('test_description', {[SQ <LIT_CHARS "signed commit tests">]})])
  (Com {[LIT_CHARS .]} {[LIT_CHARS ./test-lib.sh]})
  (= scope=<EAssignScope.GLOBAL 1> flags=0 words=[] bindings=[('GNUPGHOME_NOT_USED', {[VarSub GNUPGHOME]})])
  (Com {[LIT_CHARS .]} {[DQ [VarSub TEST_DIRECTORY][LIT_CHARS /lib-gpg.sh]]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "create signed commits">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\ttest_when_finished \"test_unconfig commit.gpgsign\" &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\techo 1 >file && git add file &&\n"> <LIT_CHARS "\ttest_tick && git commit -S -m initial &&\n"> <LIT_CHARS "\tgit tag initial &&\n"> <LIT_CHARS "\tgit branch side &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\techo 2 >file && test_tick && git commit -a -S -m second &&\n"> <LIT_CHARS "\tgit tag second &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tgit checkout side &&\n"> <LIT_CHARS "\techo 3 >elif && git add elif &&\n"> <LIT_CHARS "\ttest_tick && git commit -m \"third on side\" &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tgit checkout master &&\n"> <LIT_CHARS "\ttest_tick && git merge -S side &&\n"> <LIT_CHARS "\tgit tag merge &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\techo 4 >file && test_tick && git commit -a -m \"fourth unsigned\" &&\n"> <LIT_CHARS "\tgit tag fourth-unsigned &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\ttest_tick && git commit --amend -S -m \"fourth signed\" &&\n"> <LIT_CHARS "\tgit tag fourth-signed &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tgit config commit.gpgsign true &&\n"> <LIT_CHARS "\techo 5 >file && test_tick && git commit -a -m \"fifth signed\" &&\n"> <LIT_CHARS "\tgit tag fifth-signed &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tgit config commit.gpgsign false &&\n"> <LIT_CHARS "\techo 6 >file && test_tick && git commit -a -m \"sixth\" &&\n"> <LIT_CHARS "\tgit tag sixth-unsigned &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tgit config commit.gpgsign true &&\n"> <LIT_CHARS "\techo 7 >file && test_tick && git commit -a -m \"seventh\" --no-gpg-sign &&\n"> <LIT_CHARS "\tgit tag seventh-unsigned &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\ttest_tick && git rebase -f HEAD^^ && git tag sixth-signed HEAD^ &&\n"> <LIT_CHARS "\tgit tag seventh-signed &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\techo 8 >file && test_tick && git commit -a -m eighth -SB7227189 &&\n"> <LIT_CHARS "\tgit tag eighth-signed-alt &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\t# commit.gpgsign is still on but this must not be signed\n"> <LIT_CHARS "\tgit tag ninth-unsigned $(echo 9 | git commit-tree HEAD^{tree}) &&\n"> <LIT_CHARS "\t# explicit -S of course must sign.\n"> <LIT_CHARS "\tgit tag tenth-signed $(echo 9 | git commit-tree -S HEAD^{tree})\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "verify and show signatures">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in initial second merge fourth-signed \\\n"> <LIT_CHARS "\t\t\tfifth-signed sixth-signed seventh-signed tenth-signed\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\tgit verify-commit $commit &&\n"> <LIT_CHARS "\t\t\tgit show --pretty=short --show-signature $commit >actual &&\n"> <LIT_CHARS "\t\t\tgrep \"Good signature from\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BAD signature from\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t) &&\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in merge^2 fourth-unsigned sixth-unsigned \\\n"> <LIT_CHARS "\t\t\tseventh-unsigned ninth-unsigned\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\ttest_must_fail git verify-commit $commit &&\n"> <LIT_CHARS "\t\t\tgit show --pretty=short --show-signature $commit >actual &&\n"> <LIT_CHARS "\t\t\t! grep \"Good signature from\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BAD signature from\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t) &&\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in eighth-signed-alt\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\tgit show --pretty=short --show-signature $commit >actual &&\n"> <LIT_CHARS "\t\t\tgrep \"Good signature from\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BAD signature from\" actual &&\n"> <LIT_CHARS "\t\t\tgrep \"not certified\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t)\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "verify-commit exits success on untrusted signature">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tgit verify-commit eighth-signed-alt 2>actual &&\n"> <LIT_CHARS "\tgrep \"Good signature from\" actual &&\n"> <LIT_CHARS "\t! grep \"BAD signature from\" actual &&\n"> <LIT_CHARS "\tgrep \"not certified\" actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "verify signatures with --raw">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in initial second merge fourth-signed fifth-signed sixth-signed seventh-signed\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\tgit verify-commit --raw $commit 2>actual &&\n"> <LIT_CHARS "\t\t\tgrep \"GOODSIG\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BADSIG\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t) &&\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in merge^2 fourth-unsigned sixth-unsigned seventh-unsigned\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\ttest_must_fail git verify-commit --raw $commit 2>actual &&\n"> <LIT_CHARS "\t\t\t! grep \"GOODSIG\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BADSIG\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t) &&\n"> <LIT_CHARS "\t(\n"> <LIT_CHARS "\t\tfor commit in eighth-signed-alt\n"> <LIT_CHARS "\t\tdo\n"> <LIT_CHARS "\t\t\tgit verify-commit --raw $commit 2>actual &&\n"> <LIT_CHARS "\t\t\tgrep \"GOODSIG\" actual &&\n"> <LIT_CHARS "\t\t\t! grep \"BADSIG\" actual &&\n"> <LIT_CHARS "\t\t\tgrep \"TRUST_UNDEFINED\" actual &&\n"> <LIT_CHARS "\t\t\techo $commit OK || exit 1\n"> <LIT_CHARS "\t\tdone\n"> <LIT_CHARS "\t)\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show signed commit with signature">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tgit show -s initial >commit &&\n"> <LIT_CHARS "\tgit show -s --show-signature initial >show &&\n"> <LIT_CHARS "\tgit verify-commit -v initial >verify.1 2>verify.2 &&\n"> <LIT_CHARS "\tgit cat-file commit initial >cat &&\n"> <LIT_CHARS "\tgrep -v -e \"gpg: \" -e \"Warning: \" show >show.commit &&\n"> <LIT_CHARS "\tgrep -e \"gpg: \" -e \"Warning: \" show >show.gpg &&\n"> <LIT_CHARS "\tgrep -v \"^ \" cat | grep -v \"^gpgsig \" >cat.commit &&\n"> <LIT_CHARS "\ttest_cmp show.commit commit &&\n"> <LIT_CHARS "\ttest_cmp show.gpg verify.2 &&\n"> <LIT_CHARS "\ttest_cmp cat.commit verify.1\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "detect fudged signature">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tgit cat-file commit seventh-signed >raw &&\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tsed -e \"s/seventh/7th forged/\" raw >forged1 &&\n"> <LIT_CHARS "\tgit hash-object -w -t commit forged1 >forged1.commit &&\n"> <LIT_CHARS "\t! git verify-commit $(cat forged1.commit) &&\n"> <LIT_CHARS "\tgit show --pretty=short --show-signature $(cat forged1.commit) >actual1 &&\n"> <LIT_CHARS "\tgrep \"BAD signature from\" actual1 &&\n"> <LIT_CHARS "\t! grep \"Good signature from\" actual1\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "detect fudged signature with NUL">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tgit cat-file commit seventh-signed >raw &&\n"> <LIT_CHARS "\tcat raw >forged2 &&\n"> <LIT_CHARS "\techo Qwik | tr \"Q\" \"\\000\" >>forged2 &&\n"> <LIT_CHARS "\tgit hash-object -w -t commit forged2 >forged2.commit &&\n"> <LIT_CHARS "\t! git verify-commit $(cat forged2.commit) &&\n"> <LIT_CHARS "\tgit show --pretty=short --show-signature $(cat forged2.commit) >actual2 &&\n"> <LIT_CHARS "\tgrep \"BAD signature from\" actual2 &&\n"> <LIT_CHARS "\t! grep \"Good signature from\" actual2\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "amending already signed commit">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tgit checkout fourth-signed^0 &&\n"> <LIT_CHARS "\tgit commit --amend -S --no-edit &&\n"> <LIT_CHARS "\tgit verify-commit HEAD &&\n"> <LIT_CHARS "\tgit show -s --show-signature HEAD >actual &&\n"> <LIT_CHARS "\tgrep \"Good signature from\" actual &&\n"> <LIT_CHARS "\t! grep \"BAD signature from\" actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show good signature with custom format">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tcat >expect <<-\\EOF &&\n"> <LIT_CHARS "\tG\n"> <LIT_CHARS "\t13B6F51ECDDE430D\n"> <LIT_CHARS "\tC O Mitter <committer@example.com>\n"> <LIT_CHARS "\tEOF\n"> <LIT_CHARS "\tgit log -1 --format=\"%G?%n%GK%n%GS\" sixth-signed >actual &&\n"> <LIT_CHARS "\ttest_cmp expect actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show bad signature with custom format">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tcat >expect <<-\\EOF &&\n"> <LIT_CHARS "\tB\n"> <LIT_CHARS "\t13B6F51ECDDE430D\n"> <LIT_CHARS "\tC O Mitter <committer@example.com>\n"> <LIT_CHARS "\tEOF\n"> <LIT_CHARS "\tgit log -1 --format=\"%G?%n%GK%n%GS\" $(cat forged1.commit) >actual &&\n"> <LIT_CHARS "\ttest_cmp expect actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show untrusted signature with custom format">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tcat >expect <<-\\EOF &&\n"> <LIT_CHARS "\tU\n"> <LIT_CHARS "\t61092E85B7227189\n"> <LIT_CHARS "\tEris Discordia <discord@example.net>\n"> <LIT_CHARS "\tEOF\n"> <LIT_CHARS "\tgit log -1 --format=\"%G?%n%GK%n%GS\" eighth-signed-alt >actual &&\n"> <LIT_CHARS "\ttest_cmp expect actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show unknown signature with custom format">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tcat >expect <<-\\EOF &&\n"> <LIT_CHARS "\tE\n"> <LIT_CHARS "\t61092E85B7227189\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tEOF\n"> <LIT_CHARS "\tGNUPGHOME=\"$GNUPGHOME_NOT_USED\" git log -1 --format=\"%G?%n%GK%n%GS\" eighth-signed-alt >actual &&\n"> <LIT_CHARS "\ttest_cmp expect actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "show lack of signature with custom format">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\tcat >expect <<-\\EOF &&\n"> <LIT_CHARS "\tN\n"> <LIT_CHARS "\n"> <LIT_CHARS "\n"> <LIT_CHARS "\tEOF\n"> <LIT_CHARS "\tgit log -1 --format=\"%G?%n%GK%n%GS\" seventh-unsigned >actual &&\n"> <LIT_CHARS "\ttest_cmp expect actual\n">]})
  (Com {[LIT_CHARS test_expect_success]} {[LIT_CHARS GPG]} {[SQ <LIT_CHARS "log.showsignature behaves like --show-signature">]} {[SQ <LIT_CHARS "\n"> <LIT_CHARS "\ttest_config log.showsignature true &&\n"> <LIT_CHARS "\tgit show initial >actual &&\n"> <LIT_CHARS "\tgrep \"gpg: Signature made\" actual &&\n"> <LIT_CHARS "\tgrep \"gpg: Good signature\" actual\n">]})
  (Com {[LIT_CHARS test_done]})
)