You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
81 lines
2.6 KiB
81 lines
2.6 KiB
From ad81fa7d70111c2d29cb44a17c3511c49538d66d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
|
|
<marmarek@invisiblethingslab.com>
|
|
Date: Sat, 26 Sep 2015 06:14:05 +0200
|
|
Subject: [PATCH 2/2] Actually use repo.gpgkey - verify signatures before
|
|
installing the packages
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
Organization: Invisible Things Lab
|
|
Cc: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
|
|
|
|
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
|
|
---
|
|
imgcreate/yuminst.py | 35 +++++++++++++++++++++++++++++++++--
|
|
1 file changed, 33 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/imgcreate/yuminst.py b/imgcreate/yuminst.py
|
|
index 22e840c..17f4774 100644
|
|
--- a/imgcreate/yuminst.py
|
|
+++ b/imgcreate/yuminst.py
|
|
@@ -178,7 +178,7 @@ class LiveCDYum(yum.YumBase):
|
|
repo.metadata_expire = 0
|
|
repo.mirrorlist_expire = 0
|
|
repo.timestamp_check = 0
|
|
- # disable gpg check???
|
|
+ # disable gpg by default, enable it later when gpgkey specified
|
|
repo.gpgcheck = 0
|
|
repo.enable()
|
|
repo.setup(self.conf.cache)
|
|
@@ -195,6 +195,33 @@ class LiveCDYum(yum.YumBase):
|
|
return True
|
|
return False
|
|
|
|
+ def gpgsigcheck(self, pkgs):
|
|
+ """Perform GPG signature verification on the given packages,
|
|
+ installing keys if possible.
|
|
+
|
|
+ :param pkgs: a list of package objects to verify the GPG
|
|
+ signatures of
|
|
+ :return: non-zero if execution should stop due to an error
|
|
+ :raises: Will raise :class:`CreatorError` if there's a problem
|
|
+ """
|
|
+ for po in pkgs:
|
|
+ result, errmsg = self.sigCheckPkg(po)
|
|
+
|
|
+ if result == 0:
|
|
+ # Verified ok, or verify not req'd
|
|
+ continue
|
|
+
|
|
+ elif result == 1:
|
|
+ # keys are provided through kickstart, so treat this as consent
|
|
+ # for importing them
|
|
+ self.getKeyForPackage(po, lambda x, y, z: True)
|
|
+
|
|
+ else:
|
|
+ # Fatal error
|
|
+ raise CreatorError(errmsg)
|
|
+
|
|
+ return 0
|
|
+
|
|
|
|
def runInstall(self):
|
|
os.environ["HOME"] = "/"
|
|
@@ -211,7 +238,11 @@ class LiveCDYum(yum.YumBase):
|
|
|
|
dlpkgs = map(lambda x: x.po, filter(lambda txmbr: txmbr.ts_state in ("i", "u"), self.tsInfo.getMembers()))
|
|
self.downloadPkgs(dlpkgs)
|
|
- # FIXME: sigcheck?
|
|
+
|
|
+ # Check GPG signatures
|
|
+ if self.gpgsigcheck(dlpkgs) != 0:
|
|
+ raise CreatorError("GPG signature verification failed")
|
|
+
|
|
|
|
self.initActionTs()
|
|
self.populateTs(keepold=0)
|
|
--
|
|
2.1.0
|
|
|