Verify packages downloaded by yumdownloader (#229)

Makefile

@@ -97,6 +97,7 @@ update-repo:
 iso:
 	ln -sf `pwd` /tmp/qubes-installer
 	revisor --cli --config=conf/qubes-install.conf --model=qubes-x86_64 --install-dvd
+	rpm --checksig build/work/revisor-install/R1-Beta1/qubes-x86_64/x86_64/os/Packages/*.rpm | grep -v pgp && exit 1
 
 clean:
 	rm -fr rpm/SOURCES/*.bz2

anaconda/scripts/buildinstall

@@ -202,6 +202,7 @@ else
     BASEARCH=`python -c "import rpmUtils.arch; \
       print rpmUtils.arch.getBaseArch(myarch=rpmUtils.arch.getCanonArch(skipRpmPlatform = True));"`
     yumdownloader -c $yumconf anaconda || exit 1
+    rpm --checksig anaconda*rpm | grep -v pgp && exit 1
     rpm2cpio anaconda*rpm | cpio --quiet -iumd './usr*'
     rm -f anaconda*rpm
     popd

anaconda/scripts/mk-images

@@ -1077,6 +1077,7 @@ for KERNELARCH in $arches; do
 
         yumdownloader -c $yumconf --archlist=$KERNELARCH $kpackage
         kpackage="$kpackage.rpm"
+        rpm --checksig $kpackage.rpm | grep -v pgp && exit 1
         if [ ! -f "$kpackage" ]; then
             echo "kernel ($kernelvers) doesn't exist for $KERNELARCH.  skipping"
             continue
@@ -1101,12 +1102,14 @@ for KERNELARCH in $arches; do
         # expand out any available firmware too
         for p in $(repoquery -c $yumconf '*firmware*') ; do
             yumdownloader -c $yumconf $p
+            rpm --checksig *firmware*.rpm | grep -v pgp && exit 1
             rpm2cpio *firmware*.rpm | (cd $KERNELROOT; cpio --quiet -iumd)
             rm -f *firmware*.rpm
         done
         # and get XEN Hypervisor
         for p in $(repoquery -c $yumconf 'xen-hypervisor') ; do
             yumdownloader -c $yumconf $p
+            rpm --checksig xen-hypervisor*.rpm | grep -v pgp && exit 1
             rpm2cpio xen-hypervisor*.rpm | (cd $KERNELROOT; cpio --quiet -iumd)
             rm -f xen-hypervisor*.rpm
         done

anaconda/scripts/mk-images.efi

@@ -169,6 +169,7 @@ prepareEfiTree() {
     ydcmd="yumdownloader -c $yumconf $grubpkg"
     echo "(grubpkg) $ydcmd"
     $ydcmd
+    rpm --checksig $grubpkg.rpm | grep -v pgp && exit 1
     rpm2cpio $grubpkg.rpm | (cd $KERNELROOT; cpio --quiet -iumd)
     cp -av $KERNELROOT/boot/efi/EFI/redhat/grub.efi $MBD_BOOTTREE_TMP/EFI/BOOT/grub.efi
 
@@ -195,6 +196,7 @@ prepareEfiTree() {
     ydcmd="yumdownloader -c ${yumconf} ${artpkg}"
     echo "(artpkg) $ydcmd"
     $ydcmd
+    rpm --checksig ${artpkg}.rpm | grep -v pgp && exit 1
     rpm2cpio ${artpkg}.rpm | (cd $KERNELROOT; cpio --quiet -iumd)
     cp -av $KERNELROOT/boot/grub/splash.xpm.gz $MBD_BOOTTREE_TMP/$SPLASHPATH
 

revisor/F13-buildinstall

@@ -213,6 +213,7 @@ else
     BASEARCH=`python -c "import rpmUtils.arch; \
       print rpmUtils.arch.getBaseArch(myarch=rpmUtils.arch.getCanonArch(skipRpmPlatform = True));"`
     yumdownloader -c $yumconf anaconda || exit 1
+    rpm --checksig anaconda*rpm | grep -v pgp && exit 1
     rpm2cpio anaconda*rpm | cpio --quiet -iumd './usr*'
     rm -f anaconda*rpm
     popd