add option to export tarballs with upstream signature

Add option `--upstream-signatures=[on|auto|off]` to export-orig.
Add option `--git-upstream-signatures=[on|auto|off]` to buildpackage.

Closes: 872864

9 files changed, 152 insertions, 11 deletions

diff --git a/docs/manpages/gbp-buildpackage.xml b/docs/manpages/gbp-buildpackage.xml
index f7e3f7f3..237632e8 100644
--- a/docs/manpages/gbp-buildpackage.xml
+++ b/docs/manpages/gbp-buildpackage.xml
@@ -50,6 +50,7 @@
       <arg><option>--git-upstream-tag=</option><replaceable>tag-format</replaceable></arg>
       <arg><option>--git-force-create</option></arg>
       <arg><option>--git-no-create-orig</option></arg>
+      <arg><option>--git-upstream-signatures=</option>[auto|on|off]</arg>
       <arg><option>--git-upstream-tree=</option><replaceable>[BRANCH|SLOPPY|TAG|TREEISH]</replaceable></arg>
       <arg><option>--git-tarball-dir=</option><replaceable>DIRECTORY</replaceable></arg>
       <arg><option>--git-compression=</option><replaceable>TYPE</replaceable></arg>
@@ -277,6 +278,15 @@
           </listitem>
 	</varlistentry>
 	<varlistentry>
+          <term><option>--git-upstream-signatures=</option>[auto|on|off]
+          </term>
+          <listitem>
+            <para>
+              Whether to export the upstream tarball with signatures.
+            </para>
+          </listitem>
+	</varlistentry>
+	<varlistentry>
           <term><option>--git-[no-]submodules</option>
           </term>
           <listitem>
diff --git a/docs/manpages/gbp-export-orig.xml b/docs/manpages/gbp-export-orig.xml
index 9711e0f0..c3a1393c 100644
--- a/docs/manpages/gbp-export-orig.xml
+++ b/docs/manpages/gbp-export-orig.xml
@@ -31,6 +31,7 @@
       <arg><option>--compression-level=</option><replaceable>LEVEL</replaceable></arg>
       <arg rep='repeat'><option>--component=</option><replaceable>component</replaceable></arg>
       <arg><option>--[no-]pristine-tar</option></arg>
+      <arg><option>--upstream-signatures=</option>[auto|on|off]</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
   <refsect1>
@@ -206,6 +207,15 @@
         </listitem>
       </varlistentry>
     </variablelist>
+    <varlistentry>
+        <term><option>--upstream-signatures=</option>[auto|on|off]
+        </term>
+        <listitem>
+          <para>
+          Whether to export with upstream signatures.
+          </para>
+        </listitem>
+      </varlistentry>
   </refsect1>
   <refsect1>
     <title>EXAMPLES</title>
diff --git a/gbp/deb/git.py b/gbp/deb/git.py
index 3584f6ff..ee939a85 100644
--- a/gbp/deb/git.py
+++ b/gbp/deb/git.py
@@ -316,13 +316,22 @@ class DebianGitRepository(PkgGitRepository):
                                                                     source.upstream_version,
                                                                     comp))
 
-    def create_upstream_tarball_via_pristine_tar(self, source, output_dir, comp, component=None):
+    def create_upstream_tarball_via_pristine_tar(self, source, output_dir, comp, upstream_signatures, component=None):
         output = source.upstream_tarball_name(comp.type, component=component)
+        gbp.log.debug("upstream signature state: %s" % upstream_signatures)
+        commit, found_signature = self.get_pristine_tar_commit(source, component)
+        if not commit and self.has_pristine_tar_branch():
+            raise GitRepositoryError("Can not find pristine tar commit for archive '%s'" % output)
+        if not found_signature and upstream_signatures.is_on():
+            raise GitRepositoryError("Can not find requested upstream signature for archive '%s' in pristine tar commit." % output)
         try:
+            signature = False if upstream_signatures.is_off() else found_signature
             self.pristine_tar.checkout(source.name, source.upstream_version, comp.type, output_dir,
-                                       component=component, quiet=True)
+                                       component=component, quiet=True, signature=signature)
         except Exception as e:
-            raise GitRepositoryError("Error creating %s: %s" % (output, e))
+            raise GitRepositoryError("Error creating %s%s: %s" % (output,
+                                                                  " with attached signature file" if signature else "",
+                                                                  e))
         return True
 
     def create_upstream_tarball_via_git_archive(self, source, output_dir, treeish,
diff --git a/gbp/pkg/pristinetar.py b/gbp/pkg/pristinetar.py
index 5c0892b7..e8534076 100644
--- a/gbp/pkg/pristinetar.py
+++ b/gbp/pkg/pristinetar.py
@@ -63,25 +63,38 @@ class PristineTar(Command):
         @param archive_regexp: archive name to look for (regexp wildcards allowed)
         @type archive_regexp: C{str}
         """
-        return True if self.get_commit(archive_regexp) else False
+        return True if self.get_commit(archive_regexp)[0] else False
+
+    def _commit_contains_file(self, commit, regexp):
+        """Does the given commit contain a file with the given regex"""
+        files = self.repo.get_commit_info(commit)['files']
+        cregex = re.compile(regexp)
+        for _, v in files.items():
+            for f in v:
+                if cregex.match(f.decode()):
+                    return True
+        return False
 
     def get_commit(self, archive_regexp):
         """
         Get the pristine-tar commit of a package matching I{archive_regexp}.
+        Checks also whether the commit contains a signature file.
 
         @param archive_regexp: archive name to look for (regexp wildcards allowed)
         @type archive_regexp: C{str}
+        @return: Commit, True if commit contains a signature file
+        @rtype: C{tuple} of C{str} and C{bool}
         """
         if not self.repo.has_pristine_tar_branch():
-            return None
+            return None, False
 
         regex = ('pristine-tar .* %s' % archive_regexp)
         commits = self.repo.grep_log(regex, self.branch, merges=False)
         if commits:
             commit = commits[-1]
             gbp.log.debug("Found pristine-tar commit at '%s'" % commit)
-            return commit
-        return None
+            return commit, self._commit_contains_file(commit, '%s.asc' % archive_regexp)
+        return None, False
 
     def checkout(self, archive, quiet=False, signaturefile=None):
         """
diff --git a/gbp/scripts/buildpackage.py b/gbp/scripts/buildpackage.py
index 2aca53df..9b3d67fa 100755
--- a/gbp/scripts/buildpackage.py
+++ b/gbp/scripts/buildpackage.py
@@ -395,6 +395,8 @@ def build_parser(name, prefix=None):
                                       help="Compression type, default is '%(compression)s'")
     orig_group.add_config_file_option(option_name="compression-level", dest="comp_level",
                                       help="Compression level, default is '%(compression-level)s'")
+    orig_group.add_config_file_option(option_name="upstream-signatures", dest="upstream_signatures",
+                                      help="use upstream signatures, default is auto", type='tristate')
     orig_group.add_config_file_option("component", action="append", metavar='COMPONENT',
                                       dest="components")
     branch_group.add_config_file_option(option_name="upstream-branch", dest="upstream_branch")
diff --git a/gbp/scripts/export_orig.py b/gbp/scripts/export_orig.py
index 13be4f91..cad8297b 100755
--- a/gbp/scripts/export_orig.py
+++ b/gbp/scripts/export_orig.py
@@ -113,7 +113,8 @@ def pristine_tar_build_origs(repo, source, output_dir, options):
                                                   source.upstream_tarball_name(comp.type))))
         repo.create_upstream_tarball_via_pristine_tar(source,
                                                       output_dir,
-                                                      comp)
+                                                      comp,
+                                                      options.upstream_signatures)
         for component in options.components:
             gbp.log.info("Creating %s" %
                          os.path.abspath(os.path.join(output_dir,
@@ -121,6 +122,7 @@ def pristine_tar_build_origs(repo, source, output_dir, options):
             repo.create_upstream_tarball_via_pristine_tar(source,
                                                           output_dir,
                                                           comp,
+                                                          options.upstream_signatures,
                                                           component=component)
         return True
     except GitRepositoryError:
@@ -303,6 +305,8 @@ def build_parser(name):
                                       help="Compression type, default is '%(compression)s'")
     orig_group.add_config_file_option(option_name="compression-level", dest="comp_level",
                                       help="Compression level, default is '%(compression-level)s'")
+    orig_group.add_config_file_option(option_name="upstream-signatures", dest="upstream_signatures",
+                                      help="use upstream signature, default is auto", type='tristate')
     orig_group.add_config_file_option("component", action="append", metavar='COMPONENT',
                                       dest="components")
     branch_group.add_config_file_option(option_name="upstream-branch", dest="upstream_branch")
diff --git a/gbp/scripts/push.py b/gbp/scripts/push.py
index c897396e..8233ace8 100755
--- a/gbp/scripts/push.py
+++ b/gbp/scripts/push.py
@@ -164,7 +164,7 @@ def main(argv):
                 to_push['refs'].append((ref, get_push_src(repo, ref, utag)))
 
             if options.pristine_tar:
-                commit = repo.get_pristine_tar_commit(source)
+                commit, _ = repo.get_pristine_tar_commit(source)
                 if commit:
                     ref = 'refs/heads/pristine-tar'
                     to_push['refs'].append((ref, get_push_src(repo, ref, commit)))
diff --git a/tests/component/deb/test_export_orig.py b/tests/component/deb/test_export_orig.py
index c01562de..8ff75982 100644
--- a/tests/component/deb/test_export_orig.py
+++ b/tests/component/deb/test_export_orig.py
@@ -112,7 +112,7 @@ class TestExportOrig(ComponentTestBase):
                            '--component=foo',
                            '--pristine-tar'])
         ok_(ret == 1, "Exporting tarballs must fail")
-        self._check_log(-1, ".*git show refs/heads/pristine-tar:.*failed")
+        self._check_log(-1, "gbp:error: Can not find pristine tar commit for archive 'hello-debhelper_2.8.orig.tar.gz'")
 
     def test_tarball_dir_version_replacement(self):
         """Test that generating tarball from directory version substitution works"""
@@ -139,6 +139,90 @@ class TestExportOrig(ComponentTestBase):
             self.assertFalse(os.path.exists(os.path.join('..', t)), "Tarball %s found" % t)
             self.assertTrue(os.path.exists(os.path.join(DEB_TEST_DATA_DIR, 'foo-2.8', t)), "Tarball %s not found" % t)
 
+    def test_pristine_tar_upstream_signatures_with(self):
+        """Test that exporting upstream signatures in pristine tar works with imported signature"""
+        pkg = 'hello-debhelper'
+        dsc = self._dsc_name(pkg, '2.8-1', 'dsc-3.0')
+        files = ["%s_2.8.orig.tar.gz" % pkg,
+                 "%s_2.8.orig.tar.gz.asc" % pkg]
+
+        assert import_dsc(['arg0', '--pristine-tar', dsc]) == 0
+        ComponentTestGitRepository(pkg)
+        os.chdir(pkg)
+        for f in files:
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=no'])
+        ok_(ret == 0, "Exporting tarballs failed")
+        self.assertTrue(os.path.exists(os.path.join('..', files[0])), "Tarball %s not found" % files[0])
+        self.assertFalse(os.path.exists(os.path.join('..', files[1])), "Signature %s found" % files[1])
+
+        os.remove(os.path.join('..', files[0]))
+        for f in files:
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=auto'])
+        ok_(ret == 0, "Exporting tarballs failed")
+        for f in files:
+            self.assertTrue(os.path.exists(os.path.join('..', f)), "File %s not found" % f)
+
+        for f in files:
+            os.remove(os.path.join('..', f))
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=on'])
+        ok_(ret == 0, "Exporting tarballs failed")
+        for f in files:
+            self.assertTrue(os.path.exists(os.path.join('..', f)), "File %s not found" % f)
+
+    def test_pristine_tar_upstream_signatures_without(self):
+        """Test that exporting upstream signatures in pristine tar works without imported signature"""
+        pkg = 'hello-debhelper'
+        dsc = self._dsc_name(pkg, '2.6-1', 'dsc-3.0')
+        files = ["%s_2.6.orig.tar.gz" % pkg,
+                 "%s_2.6.orig.tar.gz.asc" % pkg]
+
+        assert import_dsc(['arg0', '--pristine-tar', dsc]) == 0
+        ComponentTestGitRepository(pkg)
+        os.chdir(pkg)
+        for f in files:
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=no'])
+        ok_(ret == 0, "Exporting tarballs failed")
+        self.assertTrue(os.path.exists(os.path.join('..', files[0])), "Tarball %s not found" % files[0])
+        self.assertFalse(os.path.exists(os.path.join('..', files[1])), "Signature %s found" % files[1])
+
+        os.remove(os.path.join('..', files[0]))
+        for f in files:
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=auto'])
+        ok_(ret == 0, "Exporting tarballs failed")
+        self.assertTrue(os.path.exists(os.path.join('..', files[0])), "Tarball %s not found" % files[0])
+        self.assertFalse(os.path.exists(os.path.join('..', files[1])), "Signature %s found" % files[1])
+
+        os.remove(os.path.join('..', files[0]))
+        for f in files:
+            self.assertFalse(os.path.exists(os.path.join('..', f)), "File %s must not exist" % f)
+
+        ret = export_orig(['arg0',
+                           '--pristine-tar',
+                           '--upstream-signatures=on'])
+        ok_(ret == 1, "Exporting tarballs must fail")
+        self._check_log(-1, "gbp:error: Can not find requested upstream signature for archive "
+                        "'hello-debhelper_2.6.orig.tar.gz' in pristine tar commit.")
+
     @RepoFixtures.quilt30(opts=['--pristine-tar'])
     def test_pristine_tar_commit_on_origin(self, repo):
         """Test that we can create tarball from 'origin/pristine-tar'"""
diff --git a/tests/doctests/test_PristineTar.py b/tests/doctests/test_PristineTar.py
index 15c614cf..dfeb7193 100644
--- a/tests/doctests/test_PristineTar.py
+++ b/tests/doctests/test_PristineTar.py
@@ -134,9 +134,18 @@ def test_pristine_has_commit():
     >>> repo.pristine_tar.has_commit('upstream', '1.0')
     True
     >>> branch = repo.rev_parse('pristine-tar')
-    >>> commit = repo.pristine_tar.get_commit('upstream_1.0.orig.tar.gz')
+    >>> commit, sig = repo.pristine_tar.get_commit('upstream_1.0.orig.tar.gz')
     >>> branch == commit
     True
+    >>> sig
+    True
+    >>> repo.pristine_tar.commit('../upstream_1.0.orig.tar.gz', 'upstream')
+    >>> branch = repo.rev_parse('pristine-tar')
+    >>> commit, sig = repo.pristine_tar.get_commit('upstream_1.0.orig.tar.gz')
+    >>> branch == commit
+    True
+    >>> sig
+    False
     """