verify gpg commit using tmp keyring and db query

1 files changed, 16 insertions, 1 deletions

diff --git a/app/models/commit.rb b/app/models/commit.rb
index 9c8edbb097d..a6a11a2d3a5 100644
--- a/app/models/commit.rb
+++ b/app/models/commit.rb
@@ -240,7 +240,22 @@ class Commit
     @signature = nil
 
     signature, signed_text = @raw.signature(project.repository)
-    if signature && signed_text
+
+    return unless signature && signed_text
+
+    Gitlab::Gpg.using_tmp_keychain do
+      # first we need to get the keyid from the signature...
+      GPGME::Crypto.new.verify(signature, signed_text: signed_text) do |verified_signature|
+        @signature = verified_signature
+      end
+
+      # ... then we query the gpg key belonging to the keyid.
+      gpg_key = GpgKey.find_by(primary_keyid: @signature.fingerprint)
+
+      return @signature unless gpg_key
+
+      Gitlab::Gpg::CurrentKeyChain.add(gpg_key.key)
+
       GPGME::Crypto.new.verify(signature, signed_text: signed_text) do |verified_signature|
         @signature = verified_signature
       end