GPG: compute the keygrip to find a secret key

The gpg-agent stores secret keys in individual files in the secret
key directory private-keys-v1.d. The files have the key's keygrip
(in upper case) as name and extension ".key".

A keygrip is a SHA1 hash over the parameters of the public key. By
computing this keygrip, we can pre-compute the expected file name and
then check only that one file instead of having to iterate over all
keys stored in that directory.

This file naming scheme is actually an implementation detail of
gpg-agent. It is unlikely to change, though. The keygrip itself is
computed via libgcrypt and will remain stable according to the GPG
main author.[1]

Add an implementation for calculating the keygrip and include tests.
Do not iterate over files in BouncyCastleGpgKeyLocator but only check
the single file identified by the keygrip.

Ideally upstream BouncyCastle would provide such a getKeyGrip() method.
But as it re-builds GPG and libgcrypt internals, it's doubtful it would
be included there, and since BouncyCastle even lacks a number of curve
OIDs for ed25519/curve25519 and uses the short-Weierstrass parameters
instead of the more common Montgomery parameters, including it there
might be quite a bit of work.

[1] http://gnupg.10057.n7.nabble.com/GnuPG-2-1-x-and-2-2-x-keyring-formats-tp54146p54154.html

Bug: 547536
Change-Id: I30022a0e7b33b1bf35aec1222f84591f0c30ddfd
Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
25 files changed
tree: 4dc95a2278643c1d8faa70875043301de94ebc6a
  1. .bazelrc
  2. .bazelversion
  3. .gitattributes
  4. .gitignore
  5. .mailmap
  6. .mvn/
  7. .settings/
  8. BUILD
  9. CONTRIBUTING.md
  10. Documentation/
  11. LICENSE
  12. README.md
  13. WORKSPACE
  14. lib/
  15. org.eclipse.jgit.ant.test/
  16. org.eclipse.jgit.ant/
  17. org.eclipse.jgit.archive/
  18. org.eclipse.jgit.benchmarks/
  19. org.eclipse.jgit.coverage/
  20. org.eclipse.jgit.gpg.bc.test/
  21. org.eclipse.jgit.gpg.bc/
  22. org.eclipse.jgit.http.apache/
  23. org.eclipse.jgit.http.server/
  24. org.eclipse.jgit.http.test/
  25. org.eclipse.jgit.junit.http/
  26. org.eclipse.jgit.junit.ssh/
  27. org.eclipse.jgit.junit/
  28. org.eclipse.jgit.lfs.server.test/
  29. org.eclipse.jgit.lfs.server/
  30. org.eclipse.jgit.lfs.test/
  31. org.eclipse.jgit.lfs/
  32. org.eclipse.jgit.packaging/
  33. org.eclipse.jgit.pgm.test/
  34. org.eclipse.jgit.pgm/
  35. org.eclipse.jgit.ssh.apache.test/
  36. org.eclipse.jgit.ssh.apache/
  37. org.eclipse.jgit.ssh.jsch.test/
  38. org.eclipse.jgit.ssh.jsch/
  39. org.eclipse.jgit.test/
  40. org.eclipse.jgit.ui/
  41. org.eclipse.jgit/
  42. pom.xml
  43. tools/
README.md

Java Git

An implementation of the Git version control system in pure Java.

This project is licensed under the EDL (Eclipse Distribution License).

JGit can be imported straight into Eclipse and built and tested from there. It can be built from the command line using Maven or Bazel. The CI builds use Maven and run on Jenkins.

  • org.eclipse.jgit

    A pure Java library capable of being run standalone, with no additional support libraries. It provides classes to read and write a Git repository and operate on a working directory.

    All portions of JGit are covered by the EDL. Absolutely no GPL, LGPL or EPL contributions are accepted within this package.

  • org.eclipse.jgit.ant

    Ant tasks based on JGit.

  • org.eclipse.jgit.archive

    Support for exporting to various archive formats (zip etc).

  • org.eclipse.jgit.http.apache

    Apache httpclient support.

  • org.eclipse.jgit.http.server

    Server for the smart and dumb Git HTTP protocol.

  • org.eclipse.jgit.lfs

    Support for LFS (Large File Storage).

  • org.eclipse.jgit.lfs.server

    Basic LFS server support.

  • org.eclipse.jgit.packaging

    Production of Eclipse features and p2 repository for JGit. See the JGit Wiki on why and how to use this module.

  • org.eclipse.jgit.pgm

    Command-line interface Git commands implemented using JGit ("pgm" stands for program).

  • org.eclipse.jgit.ssh.apache

    Client support for the ssh protocol based on Apache Mina sshd.

  • org.eclipse.jgit.ui

    Simple UI for displaying git log.

Tests

  • org.eclipse.jgit.junit, org.eclipse.jgit.junit.http, org.eclipse.jgit.junit.ssh: Helpers for unit testing
  • org.eclipse.jgit.ant.test: Unit tests for org.eclipse.jgit.ant
  • org.eclipse.jgit.http.test: Unit tests for org.eclipse.jgit.http.server
  • org.eclipse.jgit.lfs.server.test: Unit tests for org.eclipse.jgit.lfs.server
  • org.eclipse.jgit.lfs.test: Unit tests for org.eclipse.jgit.lfs
  • org.eclipse.jgit.pgm.test: Unit tests for org.eclipse.jgit.pgm
  • org.eclipse.jgit.ssh.apache.test: Unit tests for org.eclipse.jgit.ssh.apache
  • org.eclipse.jgit.test: Unit tests for org.eclipse.jgit

Warnings/Caveats

  • Native symbolic links are supported, provided the file system supports them. For Windows you must use a non-administrator account and have the SeCreateSymbolicLinkPrivilege.

  • Only the timestamp of the index is used by JGit if the index is dirty.

  • JGit requires at least a Java 8 JDK.

  • CRLF conversion is performed depending on the core.autocrlf setting, however Git for Windows by default stores that setting during installation in the "system wide" configuration file. If Git is not installed, use the global or repository configuration for the core.autocrlf setting.

  • The system wide configuration file is located relative to where C Git is installed. Make sure Git can be found via the PATH environment variable. When installing Git for Windows check the "Run Git from the Windows Command Prompt" option. There are other options like Eclipse settings that can be used for pointing out where C Git is installed. Modifying PATH is the recommended option if C Git is installed.

  • We try to use the same notation of $HOME as C Git does. On Windows this is often not the same value as the user.home system property.

Features

  • org.eclipse.jgit

    • Read loose and packed commits, trees, blobs, including deltafied objects.

    • Read objects from shared repositories

    • Write loose commits, trees, blobs.

    • Write blobs from local files or Java InputStreams.

    • Read blobs as Java InputStreams.

    • Copy trees to local directory, or local directory to a tree.

    • Lazily loads objects as necessary.

    • Read and write .git/config files.

    • Create a new repository.

    • Read and write refs, including walking through symrefs.

    • Read, update and write the Git index.

    • Checkout in dirty working directory if trivial.

    • Walk the history from a given set of commits looking for commits introducing changes in files under a specified path.

    • Object transport

      Fetch via ssh, git, http, Amazon S3 and bundles. Push via ssh, git and Amazon S3. JGit does not yet deltify the pushed packs so they may be a lot larger than C Git packs.

    • Garbage collection

    • Merge

    • Rebase

    • And much more

  • org.eclipse.jgit.pgm

    • Assorted set of command line utilities. Mostly for ad-hoc testing of jgit log, glog, fetch etc.
  • org.eclipse.jgit.ant

    • Ant tasks
  • org.eclipse.jgit.archive

    • Support for Zip/Tar and other formats
  • org.eclipse.http

    • HTTP client and server support

Missing Features

There are some missing features:

  • verifying signed commits
  • signing tags
  • signing push

Support

Post questions, comments or discussions to the jgit-dev@eclipse.org mailing list. You need to be subscribed to post. File bugs and enhancement requests in Bugzilla.

Contributing

See the EGit Contributor Guide.

About Git

More information about Git, its repository format, and the canonical C based implementation can be obtained from the Git website.