Revert 7deba93bdc76616011a9f493cbc203d60084416f and fix expired-key-sigs properly

[TheBlueMatt]

7deba93 was took the wrong approach to updating verify-commits for a key expiration. Namely, adding each commit to allow-revsig-commits should have been done instead, allowing them to still be validated, but with the expired key.

[laanwj]

ACK 9471576

[TheBlueMatt]

Added some documentation as requested, should be more clear in the future, I believe.

[laanwj]

q: Is there a command to get a list of commits signed by a certain key? If so makes sense to mention that here.

[TheBlueMatt]

Not currently, I generated the diff here with this patch:

diff --git a/contrib/verify-commits/verify-commits.sh b/contrib/verify-commits/verify-commits.sh
index 532b97a438..eb41d90941 100755
--- a/contrib/verify-commits/verify-commits.sh
+++ b/contrib/verify-commits/verify-commits.sh
@@ -62,17 +62,22 @@ while true; do
        fi
 
        if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit "$CURRENT_COMMIT" > /dev/null; then
-               if [ "$PREV_COMMIT" != "" ]; then
-                       echo "No parent of $PREV_COMMIT was signed with a trusted key!" > /dev/stderr
-                       echo "Parents are:" > /dev/stderr
-                       PARENTS=$(git show -s --format=format:%P $PREV_COMMIT)
-                       for PARENT in $PARENTS; do
-                               git show -s $PARENT > /dev/stderr
-                       done
+               export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1
+               if git -c "gpg.program=${DIR}/gpg.sh" verify-commit "$CURRENT_COMMIT" > /dev/null; then
+                       echo "$CURRENT_COMMIT" > /dev/stderr
                else
-                       echo "$CURRENT_COMMIT was not signed with a trusted key!" > /dev/stderr
+                       if [ "$PREV_COMMIT" != "" ]; then
+                               echo "No parent of $PREV_COMMIT was signed with a trusted key!" > /dev/stderr
+                               echo "Parents are:" > /dev/stderr
+                               PARENTS=$(git show -s --format=format:%P $PREV_COMMIT)
+                               for PARENT in $PARENTS; do
+                                       git show -s $PARENT > /dev/stderr
+                               done
+                       else
+                               echo "$CURRENT_COMMIT was not signed with a trusted key!" > /dev/stderr
+                       fi
+                       exit 1
                fi
-               exit 1
        fi
 
        # We always verify the top of the tree

[laanwj]

Ah yes, patching the tool to print them out makes sense.

[laanwj]

BTW: as I've started timestamping merge commits using opentimestamps, in theory it would be possible to verify the old commits using the expired key without worrying about backdating attacks. But that's probably quite involved, just an idea for the future.

[petertodd]

@laanwj Actually it should be as easy as running git log --show-signature with OTS installed. GPG will verify the signature correctly regardless of whether it's expired or revoked, albeit with a large warning. All you have to do is look at the time that OTS reports and decide for yourself if that was prior to when the key became invalid. If it is, the signature can be trusted.

[TheBlueMatt]

@petertodd care to look into a patch for gpg.sh to check if OTS is installed/at a locatoin specified by an env variable and call out to OTS if it is to aut-check that the timestamp is within a day or whatever of the claimed timestamp?

[petertodd]

@TheBlueMatt As in, just check that the timestamp on the git commit is valid? Or check that the signature is also valid? I think most of the code required to check the timestamp on an arbitrary git commit exists. So doing that last part wouldn't be too hard.

[TheBlueMatt]

@petertodd well the gpg.sh script already checks the signature, so just have to add the timestamp-checking part :p.

[laanwj]

Going to merge this for now, let's do the timestamp thing separately.