From 89564cb3b86682b4eba5ffb821e8ecdc11d04f94 Mon Sep 17 00:00:00 2001
From: lateminer <late-miner@ya.ru>
Date: Sat, 10 Nov 2018 00:03:43 +0300
Subject: [PATCH] Update contrib/verify-commits

---
 contrib/verify-commits/README.md            | 26 +++++++++++++++++++++
 contrib/verify-commits/allow-revsig-commits |  2 --
 contrib/verify-commits/gpg.sh               |  5 ++--
 contrib/verify-commits/trusted-git-root     |  2 +-
 contrib/verify-commits/trusted-keys         |  5 +---
 contrib/verify-commits/verify-commits.sh    |  5 ++--
 6 files changed, 33 insertions(+), 12 deletions(-)
 create mode 100644 contrib/verify-commits/README.md

diff --git a/contrib/verify-commits/README.md b/contrib/verify-commits/README.md
new file mode 100644
index 000000000..e9e3f65da
--- /dev/null
+++ b/contrib/verify-commits/README.md
@@ -0,0 +1,26 @@
+Tooling for verification of PGP signed commits
+----------------------------------------------
+
+This is an incomplete work in progress, but currently includes a pre-push hook
+script (`pre-push-hook.sh`) for maintainers to ensure that their own commits
+are PGP signed (nearly always merge commits), as well as a script to verify
+commits against a trusted keys list.
+
+
+Using verify-commits.sh safely
+------------------------------
+
+Remember that you can't use an untrusted script to verify itself. This means
+that checking out code, then running `verify-commits.sh` against `HEAD` is
+_not_ safe, because the version of `verify-commits.sh` that you just ran could
+be backdoored. Instead, you need to use a trusted version of verify-commits
+prior to checkout to make sure you're checking out only code signed by trusted
+keys:
+
+    git fetch origin && \
+      ./contrib/verify-commits/verify-commits.sh origin/master && \
+      git checkout origin/master
+
+Note that the above isn't a good UI/UX yet, and needs significant improvements
+to make it more convenient and reduce the chance of errors; pull-reqs
+improving this process would be much appreciated.
diff --git a/contrib/verify-commits/allow-revsig-commits b/contrib/verify-commits/allow-revsig-commits
index 31aeb8f3d..e69de29bb 100644
--- a/contrib/verify-commits/allow-revsig-commits
+++ b/contrib/verify-commits/allow-revsig-commits
@@ -1,2 +0,0 @@
-586a29253dabec3ca0f1ccba9091daabd16b8411
-eddaba7b5692288087a926da5733e86b47274e4e
diff --git a/contrib/verify-commits/gpg.sh b/contrib/verify-commits/gpg.sh
index 32a598c7d..09ff23754 100755
--- a/contrib/verify-commits/gpg.sh
+++ b/contrib/verify-commits/gpg.sh
@@ -18,10 +18,9 @@ for LINE in $(echo "$INPUT" | gpg --trust-model always "$@" 2>/dev/null); do
 	"[GNUPG:] REVKEYSIG "*)
 		[ "$BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG" != 1 ] && exit 1
 		while read KEY; do
-			case "$LINE" in "[GNUPG:] REVKEYSIG ${KEY:24:40} "*)
+			case "$LINE" in "[GNUPG:] REVKEYSIG ${KEY#????????????????????????} "*)
 				REVSIG=true
-				GOODREVSIG="[GNUPG:] GOODSIG ${KEY:24:40} "
-				;;
+				GOODREVSIG="[GNUPG:] GOODSIG ${KEY#????????????????????????} "
 			esac
 		done < ./contrib/verify-commits/trusted-keys
 		;;
diff --git a/contrib/verify-commits/trusted-git-root b/contrib/verify-commits/trusted-git-root
index 838b8d1ea..c60f8ab69 100644
--- a/contrib/verify-commits/trusted-git-root
+++ b/contrib/verify-commits/trusted-git-root
@@ -1 +1 @@
-165e323d851cc87213c7673c6f278e87a6f2e752
+82bcf405f6db1d55b684a1f63a4aabad376cdad7
diff --git a/contrib/verify-commits/trusted-keys b/contrib/verify-commits/trusted-keys
index a0d0f82db..75242c2a9 100644
--- a/contrib/verify-commits/trusted-keys
+++ b/contrib/verify-commits/trusted-keys
@@ -1,7 +1,4 @@
 71A3B16735405025D447E8F274810B012346C9A6
-1F4410F6A89268CE3197A84C57896D2FF8F0B657
-01CDF4627A3B88AAE4A571C87588242FBE38D3A8
-AF8BE07C7049F3A26B239D5325B3083201782B2F
-81291FA67D2C379A006A053FEAB5AF94D9E9ABE7
 3F1888C6DCA92A6499C4911FDBA1A67379A1A931
 32EE5C4C3FA15CCADB46ABE529D4BCB6416F53EC
+FE09B823E6D83A3BC7983EAA2D7F2372E50FE137
diff --git a/contrib/verify-commits/verify-commits.sh b/contrib/verify-commits/verify-commits.sh
index 06816bca6..cfe4f11a0 100755
--- a/contrib/verify-commits/verify-commits.sh
+++ b/contrib/verify-commits/verify-commits.sh
@@ -17,7 +17,7 @@ IS_SIGNED () {
 	if [ $1 = $VERIFIED_ROOT ]; then
 		return 0;
 	fi
-	if IS_REVSIG_ALLOWED "$1"; then
+	if [ "${REVSIG_ALLOWED#*$1}" != "$REVSIG_ALLOWED" ]; then
 		export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1
 	else
 		export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=0
@@ -25,7 +25,8 @@ IS_SIGNED () {
 	if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit $1 > /dev/null 2>&1; then
 		return 1;
 	fi
-	local PARENTS=$(git show -s --format=format:%P $1)
+	local PARENTS
+	PARENTS=$(git show -s --format=format:%P $1)
 	for PARENT in $PARENTS; do
 		if IS_SIGNED $PARENT > /dev/null; then
 			return 0;