Prototype key verification

Gemfile

@@ -58,6 +58,9 @@ gem 'validates_hostname', '~> 1.0.6'
 # Browser detection
 gem 'browser', '~> 2.2'
 
+# GPG
+gem 'gpgme'
+
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master

Gemfile.lock

@@ -332,6 +332,8 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
+    gpgme (2.0.13)
+      mini_portile2 (~> 2.1)
     grape (0.19.2)
       activesupport
       builder
@@ -983,6 +985,7 @@ DEPENDENCIES
   gollum-rugged_adapter (~> 0.4.4)
   gon (~> 6.1.0)
   google-api-client (~> 0.8.6)
+  gpgme
   grape (~> 0.19.2)
   grape-entity (~> 0.6.0)
   grape-route-helpers (~> 2.0.0)

app/models/commit.rb

@@ -234,6 +234,18 @@ class Commit
     @statuses[ref] = pipelines.latest_status(ref)
   end
 
+  def signature
+    return @signature if defined?(@signature)
+
+    sig, signed = @raw.extract_signature(project.repository.raw_repository)
+    if sig && signed
+      GPGME::Crypto.new.verify(sig, signed_text: signed) do |sign|
+        @signature = sign
+      end
+    end
+    @signature ||= nil
+  end
+
   def revert_branch_name
     "revert-#{short_id}"
   end

app/views/projects/commit/_commit_box.html.haml

@@ -6,6 +6,7 @@
     = clipboard_button(text: @commit.id, title: _("Copy commit SHA to clipboard"))
     %span.hidden-xs authored
     #{time_ago_with_tooltip(@commit.authored_date)}
+    = render partial: 'signature', object: @commit.signature
     %span= s_('ByAuthor|by')
     = author_avatar(@commit, size: 24)
     %strong

app/views/projects/commit/_signature.html.haml

+- if signature
+  %a.btn.disabled.btn-xs{ class: ('btn-success' if signature.valid?) }
+    %i.fa.fa-key{ class: ('fa-inverse' if signature.valid?) }
+    = signature.valid? ? 'Verified': 'Unverified'

app/views/projects/commits/_commit.html.haml

@@ -39,6 +39,7 @@
       .commit-actions.flex-row.hidden-xs
         - if commit.status(ref)
           = render_commit_status(commit, ref: ref)
+        = render partial: 'projects/commit/signature', object: commit.signature
         = link_to commit.short_id, project_commit_path(project, commit), class: "commit-sha btn btn-transparent"
         = clipboard_button(text: commit.id, title: _("Copy commit SHA to clipboard"))
         = link_to_browse_code(project, commit)

lib/gitlab/git/commit.rb

@@ -319,6 +319,10 @@ module Gitlab
         end
       end
 
+      def extract_signature(repo)
+        Rugged::Commit.extract_signature(repo.rugged, sha)
+      end
+
       def stats
         Gitlab::Git::CommitStats.new(self)
       end