diff --git a/.travis.yml b/.travis.yml index fb05172..2591637 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,13 +4,16 @@ language: go go: - 1.12.x + - 1.13.x + - 1.14.x - 1.x - master git: depth: false -install: '' +install: + - brew install libgit2 script: - GIT_VERSION=$(git describe --tags) diff --git a/README.md b/README.md index d449242..7b04ffb 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,32 @@ You can download prebuilt Windows binaries [here](https://github.com/github/smim - You'll probably want to put `$GOPATH/bin` on your `$PATH`. - Run `go get github.com/github/smimesign` +## Standalone usage + +```sh +$ smimesign --help +Usage: smimesign [-abhsv] [--include-certs n] [--keyid-format {long}] [--list-keys] [--status-fd n] [-t url] [-u USER-ID] [--verify] [files] + -a, --armor create ascii armored output + -b, --detach-sign make a detached signature + -h, --help print this help message + --include-certs=n -3 is the same as -2, but ommits issuer + when cert has Authority Information + Access extension. -2 includes all certs + except root. -1 includes all certs. 0 + includes no certs. 1 includes leaf cert. + >1 includes n from the leaf. Default -2. + --keyid-format={long} select how to display key IDs. + --list-keys show keys + -s, --sign make a signature + --status-fd=n write special status strings to the file + descriptor n. + -t, --timestamp-authority=url URL of RFC3161 timestamp authority to + use for timestamping + -u, --local-user=USER-ID use USER-ID to sign + --verify verify a signature + -v, --version print the version number +``` + ## Configuring Git Git needs to be told to sign commits and tags using smimesign instead of GnuPG. This can be configured on a global or per-repository level. The Git configuration directives for changing signing tools was changed in version 2.19. @@ -96,6 +122,15 @@ $ git config --get user.email $ smimesign --list-keys ``` +**Add smimesign options** + +Currently only `tsa` and `include-certs` options are supported. + +```bash +$ git config --global gpg.x509.smimesign.timestamp-authority http://timestamp.digicert.com +$ git config --global gpg.x509.smimesign.include-certs -1 +``` + ## Smart cards (PIV/CAC/Yubikey) Many large organizations and government agencies distribute certificates and keys to end users via smart cards. These cards allow applications on the user's computer to use private keys for signing or encryption without giving them the ability to export those keys. The native certificate stores on both Windows and macOS can talk to smart cards, though special drivers or middleware may be required. diff --git a/go.mod b/go.mod index 514abfd..d1f3d14 100644 --- a/go.mod +++ b/go.mod @@ -5,6 +5,7 @@ go 1.12 require ( github.com/certifi/gocertifi v0.0.0-20180118203423-deb3ae2ef261 github.com/davecgh/go-spew v1.1.1 + github.com/libgit2/git2go/v30 v30.0.1 github.com/github/certstore v0.1.0 github.com/github/fakeca v0.1.0 github.com/github/ietf-cms v0.1.0 diff --git a/go.sum b/go.sum index cf43f3c..7d0e0c7 100644 --- a/go.sum +++ b/go.sum @@ -3,6 +3,8 @@ github.com/certifi/gocertifi v0.0.0-20180118203423-deb3ae2ef261/go.mod h1:GJKEex github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/libgit2/git2go/v30 v30.0.1 h1:uvQkdor2u7WKG9p8vAZNWFRlhQx/OxRinj8ucydrTJ4= +github.com/libgit2/git2go/v30 v30.0.1/go.mod h1:YReiQ7xhMoyAL4ISYFLZt+OGqn6xtLqvTC1xJ9oAH7Y= github.com/github/certstore v0.1.0 h1:oZF2PcqgBo6YNp7gCUDfF6vP9c0kTxh5VhUNrW6d2wc= github.com/github/certstore v0.1.0/go.mod h1:Sgb3YVYOB2iCO06NJ6We5gjXe7uxxM3zPYoEXjuTKno= github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I= diff --git a/main.go b/main.go index 8d57535..f6fb03b 100644 --- a/main.go +++ b/main.go @@ -7,6 +7,7 @@ import ( "io" "os" + git "github.com/libgit2/git2go/v30" "github.com/github/certstore" "github.com/pborman/getopt/v2" "github.com/pkg/errors" @@ -72,6 +73,26 @@ func runCommand() error { return nil } + // read tsa and include-certs from gitconfig + path, err := os.Getwd() + if err == nil { + repo, err := git.OpenRepository(path) + if err == nil { + config, err := repo.Config() + + tsa, err := config.LookupString("gpg.x509.smimesign.timestamp-authority") + if err == nil { + tsaOpt = &tsa + } + + includeCerts32, err := config.LookupInt32("gpg.x509.smimesign.include-certs") + if err == nil { + var includeCerts int = int(includeCerts32) + includeCertsOpt = &includeCerts + } + } + } + // Open certificate store store, err := certstore.Open() if err != nil {