@stream44.studio/dco 0.3.0-rc.3 → 0.3.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stream44.studio/dco",
-    "version": "0.3.0-rc.3",
+    "version": "0.3.0-rc.4",
     "description": "Developer Certificate of Origin (DCO) tools for signing & verifying.",
     "private": false,
     "keywords": [
@@ -28,8 +28,8 @@
         "validate": "./validate.sh"
     },
     "dependencies": {
-        "@stream44.studio/encapsulate": "^0.4.0-rc.3",
-        "t44": "^0.4.0-rc.3"
+        "@stream44.studio/encapsulate": "^0.4.0-rc.4",
+        "t44": "^0.4.0-rc.4"
     },
     "devDependencies": {
         "@types/bun": "^1.3.4",

package/test.sh

@@ -389,8 +389,31 @@ fi
 echo -e "${GREEN}✓ --enforce-signature-fingerprints correctly fails on unsigned commits${NC}"
 echo
 
-# Test validate.sh --enforce-signature-fingerprints on the signed repo (should pass)
-echo -e "${BOLD}${YELLOW}Testing --enforce-signature-fingerprints on signed repo...${NC}"
+# Test validate.sh --enforce-signature-fingerprints on the signed repo WITHOUT allowedSignersFile
+# This simulates the GitHub Actions environment where gpg.ssh.allowedSignersFile is not configured.
+# The fix extracts SSH fingerprints directly from raw commit objects instead of relying on %G?/%GK.
+echo -e "${BOLD}${YELLOW}Testing --enforce-signature-fingerprints WITHOUT allowedSignersFile (GitHub Actions scenario)...${NC}"
+cd "$SIGNED_REPO"
+
+# Ensure allowedSignersFile is NOT set (simulates GitHub Actions)
+git config --unset gpg.ssh.allowedSignersFile 2>/dev/null || true
+
+VALIDATE_OUTPUT=$(./validate.sh "" HEAD --enforce-signature-fingerprints 2>&1) || {
+    echo -e "${RED}✗ FAIL: --enforce-signature-fingerprints should pass without allowedSignersFile${NC}"
+    echo "$VALIDATE_OUTPUT"
+    exit 1
+}
+echo "$VALIDATE_OUTPUT"
+
+if ! echo "$VALIDATE_OUTPUT" | grep -q "Signature fingerprints: enforced"; then
+    echo -e "${RED}✗ FAIL: Output should contain 'Signature fingerprints: enforced'${NC}"
+    exit 1
+fi
+echo -e "${GREEN}✓ --enforce-signature-fingerprints passes WITHOUT allowedSignersFile (raw commit extraction)${NC}"
+echo
+
+# Test validate.sh --enforce-signature-fingerprints on the signed repo WITH allowedSignersFile
+echo -e "${BOLD}${YELLOW}Testing --enforce-signature-fingerprints on signed repo (with allowedSignersFile)...${NC}"
 cd "$SIGNED_REPO"
 
 # Set up allowed signers for git to verify SSH signatures

package/validate.sh

@@ -241,6 +241,38 @@ if [[ "$ENFORCE_SIGNATURE_FINGERPRINTS" == "1" ]]; then
         SIG_VALIDATION_FAILED=true
     fi
 
+    # Extract the SSH signing fingerprint directly from the raw commit object.
+    # This avoids depending on gpg.ssh.allowedSignersFile which is typically
+    # not configured on GitHub Actions runners, causing %G? to report 'N'
+    # even when the commit contains a valid SSH signature.
+    extract_ssh_fingerprint() {
+        local commit_hash="$1"
+        local raw_commit
+        raw_commit=$(git cat-file commit "$commit_hash" 2>/dev/null)
+
+        # Check if the commit contains an SSH signature
+        if ! echo "$raw_commit" | grep -q "BEGIN SSH SIGNATURE"; then
+            echo ""
+            return
+        fi
+
+        # Extract the signature block, decode it, and compute the public key fingerprint
+        local sig_pem
+        sig_pem=$(echo "$raw_commit" | sed -n '/-----BEGIN SSH SIGNATURE-----/,/-----END SSH SIGNATURE-----/p' | sed 's/^gpgsig //' | sed 's/^ //')
+
+        python3 -c "
+import base64, hashlib, struct, sys
+lines = [l for l in sys.stdin.read().strip().split('\n') if not l.startswith('-----')]
+raw = base64.b64decode(''.join(lines))
+# SSHSIG format: magic 'SSHSIG' (6) + version uint32 (4) + public key string
+idx = 10
+pk_len = struct.unpack('>I', raw[idx:idx+4])[0]
+pk_blob = raw[idx+4:idx+4+pk_len]
+fp = base64.b64encode(hashlib.sha256(pk_blob).digest()).decode().rstrip('=')
+print(f'SHA256:{fp}')
+" <<< "$sig_pem"
+    }
+
     # Verify each commit has a valid SSH signature matching the expected fingerprint
     if [[ "$SIG_VALIDATION_FAILED" == "false" ]]; then
         while IFS= read -r commit; do
@@ -248,13 +280,12 @@ if [[ "$ENFORCE_SIGNATURE_FINGERPRINTS" == "1" ]]; then
             commit_email=$(git log -1 --format='%ae' "$commit")
             commit_subject=$(git log -1 --format='%s' "$commit")
 
-            # Get the SSH signature fingerprint from the commit
-            sig_output=$(git log -1 --format='%GK' "$commit" 2>/dev/null || true)
-            sig_status=$(git log -1 --format='%G?' "$commit" 2>/dev/null || true)
+            # Extract the SSH signature fingerprint directly from the raw commit
+            sig_fingerprint=$(extract_ssh_fingerprint "$commit")
 
-            verbose_log "Commit $commit_short: sig_status=$sig_status sig_key=$sig_output email=$commit_email"
+            verbose_log "Commit $commit_short: sig_fingerprint=$sig_fingerprint email=$commit_email"
 
-            if [[ -z "$sig_output" ]] || [[ "$sig_status" == "N" ]]; then
+            if [[ -z "$sig_fingerprint" ]]; then
                 echo -e "${RED}✗ FAIL${NC} $commit_short - ${YELLOW}$commit_subject${NC}"
                 echo -e "        ${RED}Missing SSH signature on commit${NC}"
                 SIG_VALIDATION_FAILED=true
@@ -265,26 +296,20 @@ if [[ "$ENFORCE_SIGNATURE_FINGERPRINTS" == "1" ]]; then
             expected_fp="${EXPECTED_FINGERPRINTS[$commit_email]:-}"
             if [[ -n "$expected_fp" ]]; then
                 # Compare the fingerprint from the commit signature with the expected one
-                if [[ "$sig_output" == "$expected_fp" ]]; then
+                if [[ "$sig_fingerprint" == "$expected_fp" ]]; then
                     echo -e "${GREEN}✓ PASS${NC} $commit_short - $commit_subject"
-                    echo -e "        SSH signature: ${CYAN}$sig_output${NC}"
+                    echo -e "        SSH signature: ${CYAN}$sig_fingerprint${NC}"
                 else
                     echo -e "${RED}✗ FAIL${NC} $commit_short - ${YELLOW}$commit_subject${NC}"
                     echo -e "        Expected fingerprint: ${CYAN}$expected_fp${NC}"
-                    echo -e "        Actual fingerprint:   ${CYAN}$sig_output${NC}"
+                    echo -e "        Actual fingerprint:   ${CYAN}$sig_fingerprint${NC}"
                     echo -e "        ${RED}SSH signature fingerprint mismatch${NC}"
                     SIG_VALIDATION_FAILED=true
                 fi
             else
                 # No expected fingerprint for this email — just verify it has a signature
-                if [[ "$sig_status" == "G" ]] || [[ "$sig_status" == "U" ]]; then
-                    echo -e "${GREEN}✓ PASS${NC} $commit_short - $commit_subject"
-                    echo -e "        SSH signature: ${CYAN}$sig_output${NC} (no fingerprint in .dco-signatures to cross-check)"
-                else
-                    echo -e "${RED}✗ FAIL${NC} $commit_short - ${YELLOW}$commit_subject${NC}"
-                    echo -e "        ${RED}Invalid SSH signature (status: $sig_status)${NC}"
-                    SIG_VALIDATION_FAILED=true
-                fi
+                echo -e "${GREEN}✓ PASS${NC} $commit_short - $commit_subject"
+                echo -e "        SSH signature: ${CYAN}$sig_fingerprint${NC} (no fingerprint in .dco-signatures to cross-check)"
             fi
         done <<< "$COMMITS"
     fi