-
Notifications
You must be signed in to change notification settings - Fork 278
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Malformed signed_data from Commit#extract_signature #608
Comments
Hi! Thanks for reporting this - can you share the repo that you created that illustrates this problem? |
I reproduced it just creating a repo, touching a file, and committing it with a gpg signed commit. I did this process a few times and it reproduced consistently. If you cannot get it to reproduce doing that then I'll push a repo later today that reproduces the issue |
I took another look today and I cannot get it to reproduce when creating a new repo, but this repo does demonstrate the issue: kevinoconnor7/malform-signature-test This code: require 'rugged'
repo = Rugged::Repository.new('/tmp/test')
commit = '7cd86ea426f277276367bd955f312fcbadd7bc5d'
repo.rev_parse(commit)
p Rugged::Commit.extract_signature(repo, commit)
p Rugged::Commit.extract_signature(repo, commit)
p Rugged::Commit.extract_signature(repo, commit)
p Rugged::Commit.extract_signature(repo, commit)
p Rugged::Commit.extract_signature(repo, commit) produced:
|
This looks like we might not be properly filling in the buffer, since there is no period in that commit. |
This seems to be fixed starting with 0.26.0b4. |
the rugged versions up to 0.26.0b3 had a bug concerning the signature extraction. The extracted signature was not always the same, probably due to a buffer (overflow) issue in libgit. see libgit2/rugged#608
I've been seeing weird behavior with Commit.extract_signature where I'm getting some garbage data at the end of the signed data string.
For example:
As a result the signed_data portion of the returned array sometimes has a
\n
as the last character. However, I get seemingly random data in that last byte.I was not able to reproduce this in the tests, however, I can reliably reproduce it if I create new repo locally, add a few signed commits, and then try to extract the signatures via rugged.
The text was updated successfully, but these errors were encountered: