Add test for signature veryfier

.github/workflows/diagnostics.yml

@@ -16,18 +16,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - php: '7.4'
+          - php: '8.1'
             phpcq_install: 'update'
             phpcq_flags: ''
             composer_install: 'update --prefer-lowest'
             extensions: ''
-          - php: '8.0'
-            output: '-o default'
-            phpcq_install: 'update'
-            phpcq_flags: ''
-            composer_install: 'update'
-            extensions: ''
           - php: '8.1'
+            output: '-o default'
             phpcq_install: 'update'
             phpcq_flags: ''
             composer_install: 'update'

src/Signature/SignatureVerifier.php

@@ -43,7 +43,7 @@ public function verify(string $content, string $signature): VerificationResult
             return VerificationResult::UNKOWN_ERROR();
         }
 
-        if (! $this->trustKeyStrategy->isTrusted($fingerprint)) {
+        if (!$this->isTrusted($fingerprint)) {
             return VerificationResult::UNTRUSTED_KEY($fingerprint);
         }
 
@@ -68,4 +68,15 @@ private function doVerify(string $content, string $signature): VerificationResul
 
         return VerificationResult::VALID($fingerprint);
     }
+
+    private function isTrusted(string $fingerprint): bool
+    {
+        if ($this->trustKeyStrategy->isTrusted($fingerprint)) {
+            return true;
+        }
+        if (16 < strlen($fingerprint)) {
+            return $this->trustKeyStrategy->isTrusted(substr($fingerprint, -16));
+        }
+        return false;
+    }
 }

src/Wrapper/GnuPGBinaryWrapper.php

@@ -273,10 +273,10 @@ private function parseVerifyOutput(string $result)
 
         foreach ($status as $line) {
             $parts = explode(' ', $line);
-            if (count($parts) < 3) {
+            if (count($parts) < 8) {
                 continue;
             }
-            $fingerprint = $parts[2];
+            $fingerprint = $parts[8] ?? '';
 
             if (strpos($line, 'VALIDSIG') !== false) {
                 // [GNUPG:] VALIDSIG D8406D0D82947747{...}A394072C20A 2014-07-19 1405769272 0 4 0 1 10 00 D8{...}C20A

tests/Signature/SignatureVerifierTest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Phpcq\GnuPG\Test\Signature;
+
+use Phpcq\GnuPG\Downloader\FileDownloaderInterface;
+use Phpcq\GnuPG\Downloader\KeyDownloader;
+use Phpcq\GnuPG\Exception\RuntimeException;
+use Phpcq\GnuPG\GnuPGFactory;
+use Phpcq\GnuPG\Signature\SignatureVerifier;
+use PHPUnit\Framework\TestCase;
+
+/** @covers \Phpcq\GnuPG\Signature\SignatureVerifier */
+final class SignatureVerifierTest extends TestCase
+{
+    public function testExtractingInformationWithBinaryWrapper(): void
+    {
+        $factory = new GnuPGFactory(sys_get_temp_dir());
+        try {
+            $gpg = $factory->createBinaryWrapper(sys_get_temp_dir());
+        } catch (RuntimeException $exception) {
+            self::markTestSkipped('gnupg extension not loaded');
+        }
+
+        $fileDownloader = $this->createMock(FileDownloaderInterface::class);
+        $fileDownloader->expects($this->never())->method('downloadFile');
+        $keyDownloader = new KeyDownloader($fileDownloader);
+
+        $verifier = new SignatureVerifier($gpg, $keyDownloader);
+
+        $baseDir = dirname(__DIR__);
+
+        $result = $verifier->verify(
+            file_get_contents($baseDir . '/fixtures/test.txt'),
+            file_get_contents($baseDir . '/fixtures/test.txt.asc')
+        );
+
+        self::assertTrue($result->isUntrustedKey());
+        self::assertSame('11BD3E86C5497BA1EB3B58B96DA9559564C3328F', $result->getFingerprint());
+    }
+
+    public function testExtractingInformationWithExtension(): void
+    {
+        $factory = new GnuPGFactory(sys_get_temp_dir());
+        try {
+            $gpg = $factory->createExtensionWrapper(sys_get_temp_dir());
+        } catch (RuntimeException $exception) {
+            self::markTestSkipped('gnupg extension not loaded');
+        }
+
+        $fileDownloader = $this->createMock(FileDownloaderInterface::class);
+        $fileDownloader->expects($this->never())->method('downloadFile');
+        $keyDownloader = new KeyDownloader($fileDownloader);
+
+        $verifier = new SignatureVerifier($gpg, $keyDownloader);
+
+        $baseDir = dirname(__DIR__);
+
+        $result = $verifier->verify(
+            file_get_contents($baseDir . '/fixtures/test.txt'),
+            file_get_contents($baseDir . '/fixtures/test.txt.asc')
+        );
+
+        self::assertTrue($result->isUntrustedKey());
+        self::assertSame('11BD3E86C5497BA1EB3B58B96DA9559564C3328F', $result->getFingerprint());
+    }
+}