From ad81fa7d70111c2d29cb44a17c3511c49538d66d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Sat, 26 Sep 2015 06:14:05 +0200
Subject: [PATCH 2/2] Actually use repo.gpgkey - verify signatures before
 installing the packages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Organization: Invisible Things Lab
Cc: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
---
 imgcreate/yuminst.py | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/imgcreate/yuminst.py b/imgcreate/yuminst.py
index 22e840c..17f4774 100644
--- a/imgcreate/yuminst.py
+++ b/imgcreate/yuminst.py
@@ -178,7 +178,7 @@ class LiveCDYum(yum.YumBase):
         repo.metadata_expire = 0
         repo.mirrorlist_expire = 0
         repo.timestamp_check = 0
-        # disable gpg check???
+        # disable gpg by default, enable it later when gpgkey specified
         repo.gpgcheck = 0
         repo.enable()
         repo.setup(self.conf.cache)
@@ -195,6 +195,33 @@ class LiveCDYum(yum.YumBase):
                     return True
         return False
 
+    def gpgsigcheck(self, pkgs):
+        """Perform GPG signature verification on the given packages,
+        installing keys if possible.
+
+        :param pkgs: a list of package objects to verify the GPG
+           signatures of
+        :return: non-zero if execution should stop due to an error
+        :raises: Will raise :class:`CreatorError` if there's a problem
+        """
+        for po in pkgs:
+            result, errmsg = self.sigCheckPkg(po)
+
+            if result == 0:
+                # Verified ok, or verify not req'd
+                continue
+
+            elif result == 1:
+                # keys are provided through kickstart, so treat this as consent
+                # for importing them
+                self.getKeyForPackage(po, lambda x, y, z: True)
+
+            else:
+                # Fatal error
+                raise CreatorError(errmsg)
+
+        return 0
+
 
     def runInstall(self):
         os.environ["HOME"] = "/"
@@ -211,7 +238,11 @@ class LiveCDYum(yum.YumBase):
 
         dlpkgs = map(lambda x: x.po, filter(lambda txmbr: txmbr.ts_state in ("i", "u"), self.tsInfo.getMembers()))
         self.downloadPkgs(dlpkgs)
-        # FIXME: sigcheck?
+
+        # Check GPG signatures
+        if self.gpgsigcheck(dlpkgs) != 0:
+            raise CreatorError("GPG signature verification failed")
+
 
         self.initActionTs()
         self.populateTs(keepold=0)
-- 
2.1.0

