June 2010 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] makepkg: try standard paths for coreutils du
by Allan McRae 29 Jun '10

29 Jun '10

Attempt to find "du" from coreutils in the standard paths and if not revert to the version in the users PATH. Using the full path prevents issues such as FS#19932, where a different and incompatible version of du is put earlier in the users path. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- configure.ac | 1 + scripts/Makefile.am | 1 + scripts/makepkg.sh.in | 2 +- 3 files changed, 3 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 4faf20d..7d4e60f 100644 --- a/configure.ac +++ b/configure.ac @@ -210,6 +210,7 @@ esac AM_CONDITIONAL([CYGWIN], test "x$host_os_cygwin" = "xyes") AM_CONDITIONAL([DARWIN], test "x$host_os_darwin" = "xyes") +AC_PATH_PROGS([DUPATH], [du], [du], [/usr/bin$PATH_SEPARATOR/bin] ) AC_SUBST(SIZECMD) AC_SUBST(SEDINPLACE) AC_SUBST(STRIP_BINARIES) diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 330acb9..0fde334 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -42,6 +42,7 @@ edit = sed \ -e 's|@BUILDSCRIPT[@]|$(BUILDSCRIPT)|g' \ -e 's|@SIZECMD[@]|$(SIZECMD)|g' \ -e 's|@SEDINPLACE[@]|$(SEDINPLACE)|g' \ + -e 's|@DUPATH[@]|$(DUPATH)|g' \ -e 's|@configure_input[@]|Generated from $@.in; do not edit by hand.|g' ## All the scripts depend on Makefile so that they are rebuilt when the diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 6ad83f0..f3c7217 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -902,7 +902,7 @@ write_pkginfo() { else local packager="Unknown Packager" fi - local size="$(du -sk)" + local size="$(@DUPATH@ -sk)" size="$(( ${size%%[^0-9]*} * 1024 ))" msg2 "$(gettext "Generating .PKGINFO file...")" -- 1.7.1

2 1

[pacman-dev] [PATCH] Package and database signing
by Dan McGee 29 Jun '10

29 Jun '10

From: Denis A. Altoé Falqueto <denisfalqueto(a)gmail.com> The packages and database files will have the possibility of being digitally signed, using gpg2 as the tool to sign and verify the signatures. makepkg and repo-add were changed so they can receive a key to be used in the signing process and use gpg2 instead of gpg. The case for gpg2 is that it allows user agents to be used for passphrase entry. For example, in KDE, it will open a dialog to ask for the passphrase and it will be cached for some time. It is also possible with Gnome. In simpler environments, the passphrase will be asked everytime in the command line. repo-add will store the signature of the packages added, if it exists. The signature will be stored in the section %PGPSIG% of the desc file and will have a variable length. The reason is that different key sizes generate different signature sizes. So we must be prepared for any size. libalpm was changed to check the signature in the database update and package installation (not in -U, for now). Each repository in pacman.conf can be configured to use the signature feature according to three options: Always, Optional and None. Always indicates that the signature must exists and be valid for the repository to be updated. Optional doesn't demnds the signature, but if it is present, it must be valid. None doesn't bother with signatures at all. Signed-off-by: Denis A. Altoé Falqueto <denisfalqueto(a)gmail.com> --- configure.ac | 4 - doc/makepkg.8.txt | 4 + doc/makepkg.conf.5.txt | 6 +- doc/repo-add.8.txt | 7 +- lib/libalpm/alpm.h | 2 +- lib/libalpm/be_files.c | 96 ++++++++++++++-- lib/libalpm/error.c | 2 - lib/libalpm/signing.c | 282 ++++++++++++++++++++++------------------------ lib/libalpm/signing.h | 3 +- lib/libalpm/sync.c | 2 +- scripts/.gitignore | 1 + scripts/Makefile.am | 3 + scripts/makepkg.sh.in | 32 ++++-- scripts/pacman-key.sh.in | 278 +++++++++++++++++++++++++++++++++++++++++++++ scripts/repo-add.sh.in | 63 ++++++++--- 15 files changed, 588 insertions(+), 197 deletions(-) create mode 100644 scripts/pacman-key.sh.in diff --git a/configure.ac b/configure.ac index b6ce68b..008975b 100644 --- a/configure.ac +++ b/configure.ac @@ -154,10 +154,6 @@ else fi AM_CONDITIONAL(INTERNAL_DOWNLOAD, test "x$internaldownload" = "xyes") -# Check for gpgme -AC_CHECK_LIB([gpgme], [gpgme_check_version], , - AC_MSG_ERROR([gpgme is needed to compile pacman!])) - # Checks for header files. AC_CHECK_HEADERS([fcntl.h glob.h libintl.h limits.h locale.h string.h strings.h sys/ioctl.h sys/param.h sys/statvfs.h sys/syslimits.h sys/time.h syslog.h wchar.h]) diff --git a/doc/makepkg.8.txt b/doc/makepkg.8.txt index a2fdb3f..4d8f26b 100644 --- a/doc/makepkg.8.txt +++ b/doc/makepkg.8.txt @@ -161,6 +161,10 @@ Options (Passed to pacman) Prevent pacman from displaying a progress bar; useful if you are redirecting makepkg output to file. +*\--signwithkey*:: + Select a specific key to be used to sign the package. If absent, + the default from the keyring key will be used. + Additional Features ------------------- diff --git a/doc/makepkg.conf.5.txt b/doc/makepkg.conf.5.txt index a565bd6..f82bc19 100644 --- a/doc/makepkg.conf.5.txt +++ b/doc/makepkg.conf.5.txt @@ -94,9 +94,9 @@ Options PKGBUILD options array. *sign*;; - Generate a PGP signature file using GnuPG. This will execute `gpg - --detach-sign --use-agent` on the built package to generate a detached - signature file, using the GPG agent if it is available. The signature + Generate a PGP signature file using GnuPG. This will execute `gpg2 + --detach-sign` on the built package to generate a detached signature + file, using the GPG agent if it is available. The signature file will be the entire filename of the package with a ``.sig'' extension. diff --git a/doc/repo-add.8.txt b/doc/repo-add.8.txt index e6cc940..6b8c0ef 100644 --- a/doc/repo-add.8.txt +++ b/doc/repo-add.8.txt @@ -10,9 +10,9 @@ repo-add - package database maintenance utility Synopsis -------- -repo-add [-q] <path-to-db> <package1> [<package2> ...] +repo-add [-q] [-s [-k key]] <path-to-db> <package1> [<package2> ...] -repo-remove [-q] <path-to-db> <packagename> [<packagename2> ...] +repo-remove [-q] [-s [-k key]] <path-to-db> <packagename> [<packagename2> ...] Description @@ -40,6 +40,9 @@ Options signature file, using the GPG agent if it is available. The signature file will be the entire filename of the database with a ``.sig'' extension. +*-k key*:: + Select a specific key to be used for the signing of the database file. + If absent, the default key from the default keyring will be used. See Also -------- diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 2ce049d..7eeb734 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -512,6 +512,7 @@ enum _pmerrno_t { PM_ERR_DB_NOT_FOUND, PM_ERR_DB_WRITE, PM_ERR_DB_REMOVE, + PM_ERR_DB_SIG, /* Servers */ PM_ERR_SERVER_BAD_URL, PM_ERR_SERVER_NONE, @@ -550,7 +551,6 @@ enum _pmerrno_t { /* External library errors */ PM_ERR_LIBARCHIVE, PM_ERR_LIBFETCH, - PM_ERR_GPGME, PM_ERR_EXTERNAL_DOWNLOAD }; diff --git a/lib/libalpm/be_files.c b/lib/libalpm/be_files.c index 1235165..9751b4e 100644 --- a/lib/libalpm/be_files.c +++ b/lib/libalpm/be_files.c @@ -49,7 +49,9 @@ #include "delta.h" #include "deps.h" #include "dload.h" +#include "signing.h" +#define DBSIGEXT ".sig" static int checkdbdir(pmdb_t *db) { @@ -208,7 +210,8 @@ static int remove_olddir(const char *syncdbpath, alpm_list_t *dirlist) */ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) { - char *dbfile, *dbfilepath; + char *dbfile = NULL, *dbfilepath = NULL, *dbsigfile = NULL, + *fulldbfile = NULL, *fulldbsigfile = NULL; const char *dbpath, *syncdbpath; alpm_list_t *newdirlist = NULL, *olddirlist = NULL; alpm_list_t *onlynew = NULL, *onlyold = NULL; @@ -238,17 +241,62 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) dbpath = alpm_option_get_dbpath(); ret = _alpm_download_single_file(dbfile, db->servers, dbpath, force); - free(dbfile); - if(ret == 1) { /* files match, do nothing */ pm_errno = 0; + free(dbfile); return(1); } else if(ret == -1) { /* pm_errno was set by the download code */ _alpm_log(PM_LOG_DEBUG, "failed to sync db: %s\n", alpm_strerrorlast()); + free(dbfile); return(-1); } + + /* Check the signature of the database, if it is marked as signed */ + if(db->pgp_verify != PM_PGP_VERIFY_NEVER) { + /* Assemble the signature file name */ + len = strlen(dbfile) + strlen(DBSIGEXT) + 1; + MALLOC(dbsigfile, len, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(dbsigfile, "%s" DBSIGEXT, dbfile); + + /* Try to download the signature file */ + ret = _alpm_download_single_file(dbsigfile, db->servers, dbpath, force); + if (ret == -1 && db->pgp_verify == PM_PGP_VERIFY_ALWAYS) { + _alpm_log(PM_LOG_DEBUG, "failed to download signature for db: %s\n", alpm_strerrorlast()); + free(dbfile); + free(dbsigfile); + return (-1); + } + else if (ret != -1) { + /* Assemble the full db and signature file names */ + MALLOC(fulldbfile, strlen(dbpath) + strlen(dbfile) + 2, RET_ERR(PM_ERR_MEMORY, -1)); + MALLOC(fulldbsigfile, strlen(dbpath) + strlen(dbsigfile) + 2, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(fulldbfile, "%s/%s", dbpath, dbfile); + sprintf(fulldbsigfile, "%s/%s", dbpath, dbsigfile); + + /* Check the signature */ + int ret = _alpm_gpg_checksig_file(fulldbfile, fulldbsigfile); + _alpm_log(PM_LOG_DEBUG, "return from _alpm_gpg_checksig_file = %d\n", ret); + + FREE(fulldbfile); + FREE(fulldbsigfile); + + /* VerifSig = Always -> we will only accept 0 as a correct value + * (missing or invalid signatures are errors) + * VerifSig = Optional -> we will accept 0 or -1 as correct values + * (missing signature is ok, but if it present, it must be valid) */ + if((db->pgp_verify == PM_PGP_VERIFY_ALWAYS && ret != 0) || + (db->pgp_verify == PM_PGP_VERIFY_OPTIONAL && ret == 1)) { + _alpm_log(PM_LOG_ERROR, "the signature doesn't match the repository database.\n"); + free(dbfile); + free(dbsigfile); + RET_ERR(PM_ERR_DB_SIG, -1); + } + } + FREE(dbsigfile); + } + FREE(dbfile); syncdbpath = _alpm_db_path(db); @@ -256,7 +304,7 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) len = strlen(dbpath) + strlen(db->treename) + strlen(DBEXT) + 1; MALLOC(dbfilepath, len, RET_ERR(PM_ERR_MEMORY, -1)); sprintf(dbfilepath, "%s%s" DBEXT, dbpath, db->treename); - + if(force) { /* if forcing update, remove the old dir and extract the db */ if(_alpm_rmrf(syncdbpath) != 0) { @@ -291,6 +339,10 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) ret = _alpm_unpack(dbfilepath, syncdbpath, onlynew, 0); cleanup: + if (dbsigfile != NULL) + FREE(dbsigfile); + if (dbfile != NULL) + FREE(dbfile); FREELIST(newdirlist); FREELIST(olddirlist); alpm_list_free(onlynew); @@ -437,7 +489,8 @@ int _alpm_db_read(pmdb_t *db, pmpkg_t *info, pmdbinfrq_t inforeq) char line[513]; int sline = sizeof(line)-1; char *pkgpath = NULL; - + alpm_list_t *pgpsig_lines = NULL; + ALPM_LOG_FUNC; if(db == NULL) { @@ -610,11 +663,33 @@ int _alpm_db_read(pmdb_t *db, pmpkg_t *info, pmdbinfrq_t inforeq) STRDUP(info->md5sum, _alpm_strtrim(line), goto error); } else if(strcmp(line, "%PGPSIG%") == 0) { /* PGPSIG tag only appears in sync repositories, - * not the local one. */ - if(fgets(line, 512, fp) == NULL) { - goto error; + * not the local one. The size must not be fixed, + * because the key used will affect the final size */ + pgpsig_lines = NULL; + int len = 0; + /* Create a list of strings to store the signature for now */ + while(fgets(line, sline, fp) && strlen(_alpm_strtrim(line))) { + char *linedup; + STRDUP(linedup, _alpm_strtrim(line), goto error); + pgpsig_lines = alpm_list_add(pgpsig_lines, linedup); + len += strlen(linedup); } - STRDUP(info->pgpsig.encdata, _alpm_strtrim(line), goto error); + + MALLOC(info->pgpsig.encdata, (size_t)(len + 1), goto error); + info->pgpsig.encdata[0] = '\0'; + + /* Assemble the signature from the list of strings */ + while (pgpsig_lines != NULL) { + alpm_list_t *pgpsig_line = pgpsig_lines; + pgpsig_lines = pgpsig_lines->next; + + strcat(info->pgpsig.encdata, (char *)pgpsig_line->data); + + /* Free the current node, as it is not needed anymore */ + free(pgpsig_line->data); + free(pgpsig_line); + } + pgpsig_lines = NULL; } else if(strcmp(line, "%REPLACES%") == 0) { while(fgets(line, sline, fp) && strlen(_alpm_strtrim(line))) { char *linedup; @@ -731,6 +806,9 @@ int _alpm_db_read(pmdb_t *db, pmpkg_t *info, pmdbinfrq_t inforeq) return(0); error: + if (pgpsig_lines) { + FREELIST(pgpsig_lines); + } free(pkgpath); if(fp) { fclose(fp); diff --git a/lib/libalpm/error.c b/lib/libalpm/error.c index 907a9f2..1fccc46 100644 --- a/lib/libalpm/error.c +++ b/lib/libalpm/error.c @@ -158,8 +158,6 @@ const char SYMEXPORT *alpm_strerror(int err) /* obviously shouldn't get here... */ return _("download library error"); #endif - case PM_ERR_GPGME: - return _("gpgme error"); case PM_ERR_EXTERNAL_DOWNLOAD: return _("error invoking external downloader"); /* Unknown error! */ diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 2b15528..80eba15 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -17,13 +17,8 @@ * along with this program. If not, see <http://www.gnu.org/licenses/>. */ -#include "config.h" - -#include <stdlib.h> #include <stdio.h> -#include <string.h> -#include <locale.h> /* setlocale() */ -#include <gpgme.h> +#include <errno.h> /* libalpm */ #include "signing.h" @@ -32,169 +27,158 @@ #include "log.h" #include "alpm.h" -#define CHECK_ERR(void) do { \ - if(err != GPG_ERR_NO_ERROR) { goto error; } \ - } while(0) +// Max length of the command line string. I believe that it is enough... +#define MAX_COMMAND 2048 +#define MAX_LINE 1024 +#define TRUST_MARGINAL "[GNUPG:] TRUST_MARGINAL" +#define TRUST_FULLY "[GNUPG:] TRUST_FULLY" +#define TRUST_ULTIMATE "[GNUPG:] TRUST_ULTIMATE" + +// Names of files related to the keyring +#define PACMAN_KEYRING_DIR "/etc/pacman.d/gnupg" +#define PACMAN_SECRET "secret.gpg" +#define PACMAN_TRUSTDB "trustdb.gpg" +#define PACMAN_KEYRING "pacman.gpg" +#define PACMAN_SHARE_DIR "/usr/share/pacman" + +// Commands and common parameters +#define GPG_PROGRAM "gpg2" +#define GPG GPG_PROGRAM " --ignore-time-conflict --no-options --no-default-keyring" +#define GPG_PACMAN GPG " --status-fd 1 --homedir " PACMAN_KEYRING_DIR " --secret-keyring " \ + PACMAN_KEYRING_DIR "/" PACMAN_SECRET " --trustdb-name " PACMAN_KEYRING_DIR \ + "/" PACMAN_TRUSTDB " --keyring " PACMAN_KEYRING_DIR "/" PACMAN_KEYRING \ + " --primary-keyring " PACMAN_KEYRING_DIR "/" PACMAN_KEYRING " 2> /dev/null" -static int gpgme_init(void) +/** + * Check the PGP package signature for the given package file. + * The signature is stored on memory, so it needs to be saved to + * a temporary file. + * @param pkgpath the full path to a package file + * @param sig PGP signature data in raw form (already decoded) + * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) + */ +int _alpm_gpg_checksig_memory(const char *pkgpath, const pmpgpsig_t *sig) { - static int init = 0; - const char *version; - gpgme_error_t err; - gpgme_engine_info_t enginfo; - - ALPM_LOG_FUNC; - - if(init) { - /* we already successfully initialized the library */ - return(0); + int status = 1, i; + char *tmpName = NULL; + FILE *tmpSig = NULL; + + // Get a temporary file, which will store the signature. + while (tmpSig == NULL) { + tmpName = tempnam(NULL, "pacman"); + if (tmpName == NULL) { + _alpm_log(PM_LOG_ERROR, _("Unable to create a temporary file name.\n")); + status = -1; + goto cleanup; + } + _alpm_log(PM_LOG_DEBUG, "tmpName: \'%s\'\n", tmpName); + + // Write the signature to the temporary file + tmpSig = fopen(tmpName, "w+x"); + if (tmpSig == NULL && errno == EEXIST) { + _alpm_log(PM_LOG_DEBUG, "the temporary file already exists\n"); + FREE(tmpName); + } else if (tmpSig == NULL) { + _alpm_log(PM_LOG_ERROR, _("Unable to create a temporary file.\n")); + status = -1; + goto cleanup; + } } - if(!alpm_option_get_signaturedir()) { - RET_ERR(PM_ERR_SIG_MISSINGDIR, 1); + // Copy the signature into the temp file + // Write the bytes at once, to make it more efficient + for (i = 0; i < sig->rawlen; i++) { + if (fputc(sig->rawdata[i], tmpSig) == EOF) { + _alpm_log(PM_LOG_ERROR, _("Error writing signature to temporary file\n")); + status = -1; + goto cleanup; + } } - /* calling gpgme_check_version() returns the current version and runs - * some internal library setup code */ - version = gpgme_check_version(NULL); - _alpm_log(PM_LOG_DEBUG, "GPGME version: %s\n", version); - gpgme_set_locale(NULL, LC_CTYPE, setlocale(LC_CTYPE, NULL)); -#ifdef LC_MESSAGES - gpgme_set_locale(NULL, LC_MESSAGES, setlocale(LC_MESSAGES, NULL)); -#endif - /* NOTE: - * The GPGME library installs a SIGPIPE signal handler automatically if - * the default signal hander is in use. The only time we set a handler - * for SIGPIPE is in dload.c, and we reset it when we are done. Given that - * we do this, we can let GPGME do its automagic. However, if we install - * a library-wide SIGPIPE handler, we will have to be careful. - */ - - /* check for OpenPGP support (should be a no-brainer, but be safe) */ - err = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP); - CHECK_ERR(); - - /* set and check engine information */ - err = gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP, NULL, - alpm_option_get_signaturedir()); - CHECK_ERR(); - err = gpgme_get_engine_info(&enginfo); - CHECK_ERR(); - _alpm_log(PM_LOG_DEBUG, "GPGME engine info: file=%s, home=%s\n", - enginfo->file_name, enginfo->home_dir); - - init = 1; - return(0); - -error: - _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err)); - RET_ERR(PM_ERR_GPGME, 1); + // Close the temporary file so that gpg can use it + fclose(tmpSig); + tmpSig = NULL; + + // Calls the function that checks the signature in a file + status = _alpm_gpg_checksig_file(pkgpath, tmpName); +cleanup: + if (tmpSig != NULL) { + fclose(tmpSig); + } + if (tmpName != NULL) { + // Delete the temporary file, if it exists + if (access(tmpName, F_OK) != -1) { + remove(tmpName); + } + + FREE(tmpName); + } + return status; } /** * Check the PGP package signature for the given package file. + * The signature is stored in a file, which is passed to gpg. * @param pkgpath the full path to a package file - * @param sig PGP signature data in raw form (already decoded) + * @param sigpath path to the PGP Signature file. * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) */ -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) +int _alpm_gpg_checksig_file(const char *pkgpath, const char *sigpath) { - int ret = 0; - gpgme_error_t err; - gpgme_ctx_t ctx; - gpgme_data_t pkgdata, sigdata; - gpgme_verify_result_t result; - gpgme_signature_t gpgsig; - FILE *pkgfile = NULL, *sigfile = NULL; - - ALPM_LOG_FUNC; - - if(!sig || !sig->rawdata) { - RET_ERR(PM_ERR_SIG_UNKNOWN, -1); - } - if(!pkgpath || access(pkgpath, R_OK) != 0) { - RET_ERR(PM_ERR_PKG_NOT_FOUND, -1); + int status = 1; + char *command = NULL, *line = NULL; + FILE *output = NULL; + int resultCommand = 0, statusCommand = 0, trusted = 0; + + CALLOC(command, MAX_COMMAND, sizeof(char), RET_ERR(PM_ERR_MEMORY, NULL)); + + if (snprintf(command, MAX_COMMAND, GPG_PACMAN " --verify %s %s", sigpath, pkgpath) >= MAX_COMMAND) { + _alpm_log(PM_LOG_ERROR, _("The gpg command string is too long\n")); + status = -1; + goto cleanup; } - if(gpgme_init()) { - /* pm_errno was set in gpgme_init() */ - return(-1); + _alpm_log(PM_LOG_DEBUG, "gpg command is: \'%s\'\n", command); + + output = popen(command, "r"); + if (output == NULL) { + _alpm_log(PM_LOG_ERROR, _("Error calling gpg2 external program\n")); + status = -1; + goto cleanup; } - err = gpgme_new(&ctx); - CHECK_ERR(); - - /* create our necessary data objects to verify the signature */ - /* first the package itself */ - pkgfile = fopen(pkgpath, "rb"); - if(pkgfile == NULL) { - pm_errno = PM_ERR_PKG_OPEN; - ret = -1; - goto error; - } - err = gpgme_data_new_from_stream(&pkgdata, pkgfile); - CHECK_ERR(); - - /* next create data object for the signature */ - err = gpgme_data_new_from_mem(&sigdata, (char*)sig->rawdata, sig->rawlen, 0); - CHECK_ERR(); - - /* here's where the magic happens */ - err = gpgme_op_verify(ctx, sigdata, pkgdata, NULL); - CHECK_ERR(); - result = gpgme_op_verify_result(ctx); - gpgsig = result->signatures; - if (!gpgsig || gpgsig->next) { - _alpm_log(PM_LOG_ERROR, _("Unexpected number of signatures\n")); - ret = -1; - goto error; - } - fprintf(stdout, "\nsummary=%x\n", gpgsig->summary); - fprintf(stdout, "fpr=%s\n", gpgsig->fpr); - fprintf(stdout, "status=%d\n", gpgsig->status); - fprintf(stdout, "timestamp=%lu\n", gpgsig->timestamp); - fprintf(stdout, "wrong_key_usage=%u\n", gpgsig->wrong_key_usage); - fprintf(stdout, "pka_trust=%u\n", gpgsig->pka_trust); - fprintf(stdout, "chain_model=%u\n", gpgsig->chain_model); - fprintf(stdout, "validity=%d\n", gpgsig->validity); - fprintf(stdout, "validity_reason=%d\n", gpgsig->validity_reason); - fprintf(stdout, "key=%d\n", gpgsig->pubkey_algo); - fprintf(stdout, "hash=%d\n", gpgsig->hash_algo); - - if(gpgsig->summary & GPGME_SIGSUM_VALID) { - /* good signature, continue */ - _alpm_log(PM_LOG_DEBUG, _("Package %s has a valid signature.\n"), - pkgpath); - } else if(gpgsig->summary & GPGME_SIGSUM_GREEN) { - /* 'green' signature, not sure what to do here */ - _alpm_log(PM_LOG_WARNING, _("Package %s has a green signature.\n"), - pkgpath); - } else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) { - pm_errno = PM_ERR_SIG_UNKNOWN; - _alpm_log(PM_LOG_WARNING, _("Package %s has a signature from an unknown key.\n"), - pkgpath); - ret = -1; - } else { - /* we'll capture everything else here */ - pm_errno = PM_ERR_SIG_INVALID; - _alpm_log(PM_LOG_ERROR, _("Package %s has an invalid signature.\n"), - pkgpath); - ret = 1; + + // Read the output of the command to see if there are lines with the pattern + // TRUST_MARGINAL, TRUST_FULLY or TRUST_ULTIMATE. These results indicate that + // the level of trust of the key are at leas MARGINAL, which means that the + // users trusts the signer or there is a path in the web of trust that + // assigns at least the MARGINAL level + CALLOC(line, MAX_LINE, sizeof(char), RET_ERR(PM_ERR_MEMORY, NULL)); + while (fgets(line, MAX_LINE, output)) { + // Debug of status messages from gpg + if (strncmp(line, "[GNUPG:]", (size_t)strlen("[GNUPG:]")) == 0) { + _alpm_log(PM_LOG_DEBUG, "%s\n", line); + } + if (strncmp(line, TRUST_MARGINAL, (size_t)strlen(TRUST_MARGINAL)) == 0 || + strncmp(line, TRUST_FULLY, (size_t)strlen(TRUST_FULLY)) == 0 || + strncmp(line, TRUST_ULTIMATE, (size_t)strlen(TRUST_ULTIMATE)) == 0) { + trusted = 1; + } } + + resultCommand = pclose(output); -error: - gpgme_data_release(sigdata); - gpgme_data_release(pkgdata); - gpgme_release(ctx); - if(sigfile) { - fclose(sigfile); + // We don't need to check the return status of the command, because the + // trusted variable only is 1 if the signature is valid and trusted. + if (trusted == 1) { + status = 0; } - if(pkgfile) { - fclose(pkgfile); +cleanup: + if (line) { + FREE(line); } - if(err != GPG_ERR_NO_ERROR) { - _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err)); - RET_ERR(PM_ERR_GPGME, -1); + if (command) { + FREE(command); } - return(ret); + return status; } /** @@ -207,7 +191,7 @@ int SYMEXPORT alpm_pkg_check_pgp_signature(pmpkg_t *pkg) ALPM_LOG_FUNC; ASSERT(pkg != NULL, return(0)); - return(_alpm_gpgme_checksig(alpm_pkg_get_filename(pkg), + return(_alpm_gpg_checksig_memory(alpm_pkg_get_filename(pkg), alpm_pkg_get_pgpsig(pkg))); } diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index c004697..fe28a22 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -21,7 +21,8 @@ #include "alpm.h" -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig); +int _alpm_gpg_checksig_memory(const char *pkgpath, const pmpgpsig_t *sig); +int _alpm_gpg_checksig_file(const char *pkgpath, const char *sigpath); #endif /* _ALPM_SIGNING_H */ diff --git a/lib/libalpm/sync.c b/lib/libalpm/sync.c index 3994d5d..aa1fffe 100644 --- a/lib/libalpm/sync.c +++ b/lib/libalpm/sync.c @@ -938,7 +938,7 @@ int _alpm_sync_commit(pmtrans_t *trans, pmdb_t *db_local, alpm_list_t **data) pmdb_t *sdb = alpm_pkg_get_db(spkg); if(sdb->pgp_verify != PM_PGP_VERIFY_NEVER) { - int ret = _alpm_gpgme_checksig(filepath, pgpsig); + int ret = _alpm_gpg_checksig_memory(filepath, pgpsig); if((sdb->pgp_verify == PM_PGP_VERIFY_ALWAYS && ret != 0) || (sdb->pgp_verify == PM_PGP_VERIFY_OPTIONAL && ret == 1)) { errors++; diff --git a/scripts/.gitignore b/scripts/.gitignore index eafc493..1c662de 100644 --- a/scripts/.gitignore +++ b/scripts/.gitignore @@ -4,3 +4,4 @@ rankmirrors repo-add repo-remove pkgdelta +pacman-key diff --git a/scripts/Makefile.am b/scripts/Makefile.am index 330acb9..d4f96de 100644 --- a/scripts/Makefile.am +++ b/scripts/Makefile.am @@ -7,6 +7,7 @@ bin_SCRIPTS = \ OURSCRIPTS = \ makepkg \ + pacman-key \ pacman-optimize \ pkgdelta \ rankmirrors \ @@ -14,6 +15,7 @@ OURSCRIPTS = \ EXTRA_DIST = \ makepkg.sh.in \ + pacman-key.sh.in \ pacman-optimize.sh.in \ pkgdelta.sh.in \ rankmirrors.sh.in \ @@ -60,6 +62,7 @@ $(OURSCRIPTS): Makefile @mv $@.tmp $@ makepkg: $(srcdir)/makepkg.sh.in +pacman-key: ${srcdir}/pacman-key.sh.in pacman-optimize: $(srcdir)/pacman-optimize.sh.in pkgdelta: $(srcdir)/pkgdelta.sh.in rankmirrors: $(srcdir)/rankmirrors.sh.in diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index 223bf12..cb25312 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -28,7 +28,7 @@ # makepkg uses quite a few external programs during its execution. You # need to have at least the following installed for makepkg to function: # bsdtar (libarchive), bzip2, coreutils, fakeroot, find (findutils), -# gettext, grep, gzip, openssl, sed, tput (ncurses), xz +# gettext, grep, gzip, openssl, sed, tput (ncurses), xz, gpg # gettext initialization export TEXTDOMAIN='pacman' @@ -43,6 +43,8 @@ BUILDSCRIPT='@BUILDSCRIPT@' startdir="$PWD" srcdir="$startdir/src" pkgdir="$startdir/pkg" +GPG="gpg2" +SIG_EXT=".sig" packaging_options=('strip' 'docs' 'libtool' 'emptydirs' 'zipman' 'purge') other_options=('ccache' 'distcc' 'makeflags' 'force') @@ -74,6 +76,7 @@ BUILDFUNC=0 PKGFUNC=0 SPLITPKG=0 PKGLIST="" +SIGNKEY="" # Forces the pkgver of the current PKGBUILD. Used by the fakeroot call # when dealing with svn/cvs/etc PKGBUILDs. @@ -1028,7 +1031,7 @@ create_package() { local ret=0 [[ -f $pkg_file ]] && rm -f "$pkg_file" - [[ -f $pkg_file.sig ]] && rm -f "$pkg_file.sig" + [[ -f ${pkg_file}${SIG_EXT} ]] && rm -f "${pkg_file}${SIG_EXT}" # when fileglobbing, we want * in an empty directory to expand to # the null string rather than itself @@ -1055,7 +1058,7 @@ create_package() { if (( ! ret )) && [[ "$PKGDEST" != "${startdir}" ]]; then ln -sf "${pkg_file}" "${pkg_file/$PKGDEST/$startdir}" ret=$? - [[ -f $pkg_file.sig ]] && ln -sf "$pkg_file.sig" "${pkg_file/$PKGDEST/$startdir}.sig" + [[ -f ${pkg_file}${SIG_EXT} ]] && ln -sf "${pkg_file}${SIG_EXT}" "${pkg_file/$PKGDEST/$startdir}${SIG_EXT}" fi if (( ret )); then @@ -1070,13 +1073,24 @@ create_signature() { local ret=0 local filename="$1" msg "$(gettext "Signing package...")" - if [ ! $(type -p "gpg") ]; then - error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")" + if [[ ! $(type -p "${GPG}") ]]; then + error "$(gettext "Cannot find the ${GPG} binary! Is gnupg installed?")" exit 1 # $E_MISSING_PROGRAM fi - gpg --detach-sign --use-agent "$filename" || ret=$? + + # Check if SIGNKEY is valid. + local SIGNWITHKEY="" + if [[ "${SIGNKEY}" ]]; then + if ! ${GPG} --list-key "${SIGNKEY}" 1>/dev/null 2>&1; then + error "$(gettext "The key ${SIGNKEY} doesn\'t exist.")" + exit 1 + fi + SIGNWITHKEY="-u ${SIGNKEY}" + fi + # The signature will be generated directly in ascii-friendly format + ${GPG} --detach-sign ${SIGNWITHKEY} "$filename" || ret=$? if (( ! ret )); then - msg2 "$(gettext "Created signature file %s.")" "$filename.sig" + msg2 "$(gettext "Created signature file %s.")" "${filename}${SIG_EXT}" else warning "$(gettext "Failed to sign package file.")" fi @@ -1522,6 +1536,7 @@ usage() { echo "$(gettext " --pkg <list> Only build listed packages from a split package")" echo "$(gettext " --skipinteg Do not fail when integrity checks are missing")" echo "$(gettext " --source Generate a source-only tarball without downloaded sources")" + echo "$(gettext " --signwithkey Selects an specific key to use for signing")" echo echo "$(gettext "These options can be passed to pacman:")" echo @@ -1557,7 +1572,7 @@ OPT_SHORT="AcCdefFghiLmop:rRsV" OPT_LONG="allsource,asroot,ignorearch,clean,cleancache,nodeps" OPT_LONG="$OPT_LONG,noextract,force,forcever:,geninteg,help,holdver" OPT_LONG="$OPT_LONG,install,log,nocolor,nobuild,pkg:,rmdeps,repackage,skipinteg" -OPT_LONG="$OPT_LONG,source,syncdeps,version,config:" +OPT_LONG="$OPT_LONG,source,syncdeps,version,config:,signwithkey" # Pacman Options OPT_LONG="$OPT_LONG,noconfirm,noprogressbar" OPT_TEMP="$(parse_options $OPT_SHORT $OPT_LONG "$@" || echo 'PARSE_OPTIONS FAILED')" @@ -1600,6 +1615,7 @@ while true; do --skipinteg) SKIPINTEG=1 ;; --source) SOURCEONLY=1 ;; -s|--syncdeps) DEP_BIN=1 ;; + --signwithkey) shift; SIGNKEY=$1 ;; -h|--help) usage; exit 0 ;; # E_OK -V|--version) version; exit 0 ;; # E_OK diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in new file mode 100644 index 0000000..a33c684 --- /dev/null +++ b/scripts/pacman-key.sh.in @@ -0,0 +1,278 @@ +#!/bin/bash -e +# +# pacman-key - manages pacman's keyring +# @configure_input@ +# +# Copyright (c) 2010 - Denis A. Altoé Falqueto <denisfalqueto(a)gmail.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +# gettext initialization +export TEXTDOMAIN='pacman' +export TEXTDOMAINDIR='@localedir@' + +# Based on apt-key, from Debian +# Author: Denis A. Altoé Falqueto <denisfalqueto at gmail dot com> + +PACMAN_KEY_VERSION="0.1" + +# According to apt-key, gpg doesn't like to be called without a secret keyring. +# We will not really need one, because pacman will not sign packages, just verify +# their integrities. +PACMAN_KEYRING_DIR="/etc/pacman.d/gnupg" +PACMAN_SECRET="secret.gpg" +PACMAN_TRUSTDB="trustdb.gpg" +PACMAN_KEYRING="pacman.gpg" +PACMAN_SHARE_DIR="/usr/share/pacman" + +# Default parameters for the command gpg. Some more will be added when needed +GPG_PROGRAM="gpg2" +GPG="${GPG_PROGRAM} --ignore-time-conflict --no-options --no-default-keyring" +GPG_PACMAN="${GPG} --homedir ${PACMAN_KEYRING_DIR} --secret-keyring ${PACMAN_KEYRING_DIR}/${PACMAN_SECRET} \ + --trustdb-name ${PACMAN_KEYRING_DIR}/${PACMAN_TRUSTDB} --keyring ${PACMAN_KEYRING_DIR}/${PACMAN_KEYRING} \ + --primary-keyring ${PACMAN_KEYRING_DIR}/${PACMAN_KEYRING}" +SIG_EXT=".sig" + +# Read-only keyring with keys to be added to the keyring +ADDED_KEYS="${PACMAN_SHARE_DIR}/addedkeys.gpg" + +# Read-only keyring with keys removed from the keyring. They need to be removed before +# the keys from the added keyring be really imported +REMOVED_KEYS="${PACMAN_SHARE_DIR}/removedkeys.gpg" + +usage() { + echo "pacman-key - Pacman's keyring management utility" + echo "Usage: $(basename $0) command [arguments]" + echo + echo "Manage pacman's list of trusted keys" + echo + echo " pacman-key add <file> ... - add the key contained in <file> ('-' for stdin)" + echo " pacman-key del <keyid> ... - remove the key <keyid>" + echo " pacman-key export <keyid> ... - output the key <keyid>" + echo " pacman-key exportall - output all trusted keys" + echo " pacman-key receive <keyserver> <keyid> ... - fetch the keyids from the specified keyserver URL" + echo " pacman-key trust <keyid> ... - set the truslevel of the given key" + echo " pacman-key updatedb - update the trustdb of pacman" + echo " pacman-key reload - reloads the keys from the keyring package" + echo " pacman-key list - list keys" + echo " pacman-key finger <keyid> ... - list fingerprints" + echo " pacman-key adv <params> - pass advanced options to gpg" + echo " pacman-key help - displays this message" + echo " pacman-key version - displays the current version" + echo + echo "If no specific keyring file is given the command applies to the default keyring." +} + +prepare_homedir() { + if [[ ! -d ${PACMAN_KEYRING_DIR} ]] ; then + mkdir -p "${PACMAN_KEYRING_DIR}" + [[ ! -f "${PACMAN_KEYRING_DIR}/${PACMAN_SECRET}" ]] && touch "${PACMAN_KEYRING_DIR}/${PACMAN_SECRET}" + [[ ! -f "${PACMAN_KEYRING_DIR}/${PACMAN_KEYRING}" ]] && touch "${PACMAN_KEYRING_DIR}/${PACMAN_KEYRING}" + chmod 700 "${PACMAN_KEYRING_DIR}" + chmod 600 "${PACMAN_KEYRING_DIR}"/* + fi +} + +add_key() { + ${GPG_PACMAN} --quiet --batch --import "$1" +} + +remove_key() { + ${GPG_PACMAN} --quiet --batch --delete-key --yes "$1" +} + +update_trustdb() { + ${GPG_PACMAN} --batch --check-trustdb +} + +list_sigs() { + ${GPG_PACMAN} --batch --list-sigs +} + +list_fingerprints() { + ${GPG_PACMAN} --batch --fingerprint $* +} + +export_key() { + ${GPG_PACMAN} --armor --export "$1" +} + +export_all() { + ${GPG_PACMAN} --armor --export +} + +trust_key() { + # Verify if the key exists in pacman's keyring + if ${GPG_PACMAN} --list-key "$1" > /dev/null 2>&1 ; then + ${GPG_PACMAN} --fingerprint "$1" + ${GPG_PACMAN} --edit-key "$1" + else + echo "The key identified by $1 doesn't exist" + exit 1 + fi +} + +reload_keyring() { + # Verify the signature of removed keys file + if [[ -f ${REMOVED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${REMOVED_KEYS}${SIG_EXT} ; then + echo "The signature of file ${REMOVED_KEYS} is not valid." + exit 1 + fi + + # Verify the signature of the added keys file + if [[ -f ${ADDED_KEYS} ]] && ! ${GPG_PACMAN} --quiet --verify ${ADDED_KEYS}${SIG_EXT} ; then + echo "The signature of file ${ADDED_KEYS} is not valid." + exit 1 + fi + + # Remove the keys from REMOVED_KEYS keyring + [[ -r ${REMOVED_KEYS} ]] && cat "${REMOVED_KEYS}" | while read key ; do + ${GPG_PACMAN} --quiet --batch --yes --delete-keys ${key} + done + + # Add keys from the current set of keys from pacman-keyring package. The web of trust will + # be updated automatically. + if [[ -r ${ADDED_KEYS} ]] ; then + add_keys=$(${GPG} --keyring ${ADDED_KEYS} --with-colons --list-keys | grep ^pub | cut -d: -f5) + for add_key in $add_keys; do + echo "Chave $add_key" + ${GPG} --quiet --batch --keyring $ADDED_KEYS --export $add_key | ${GPG_PACMAN} --import + ADDED=1 + done + fi + + # Update trustdb, just to be sure + update_trustdb +} + +receive() { + keyserver="$1" + shift + ${GPG_PACMAN} --keyserver ${keyserver} $* +} + +# PROGRAM START + +if ! type gettext &>/dev/null; then + gettext() { + echo "$@" + } +fi + +command="$1" +if [[ -z "$command" ]]; then + usage + exit 1 +fi +shift + +if [[ "$command" != "version" && "$command" != "help" ]] && ! which "${GPG_PROGRAM}" >/dev/null 2>&1; then + echo >&2 "Warning: gnupg does not seem to be installed." + echo >&2 "Warning: pacman-key requires gnupg for most operations." + echo >&2 +fi + +prepare_homedir + +case "$command" in + add) + if (( $# == 0 )) ; then + echo "You need to specify at least one key identifier" + usage + exit 1 + fi + while (( $# > 0 )) ; do + add_key $1 + shift + done + ;; + del|rm|remove) + if (( $# == 0 )) ; then + echo "You need to specify at least one key identifier" + usage + exit 1 + fi + while (( $# > 0 )) ; do + remove_key $1 + shift + done + ;; + updatedb) + update_trustdb + ;; + reload) + reload_keyring + ;; + list) + list_sigs + ;; + finger*) + if (( $# == 0 )) ; then + echo "You need to specify at least one key identifier" + usage + exit 1 + fi + list_fingerprints $* + ;; + export) + if (( $# == 0 )) ; then + echo "You need to specify at least one key identifier" + usage + exit 1 + fi + while (( $# > 0 )) ; do + export_key $1 + shift + done + ;; + exportall) + export_all + ;; + receive) + if (( $# < 2 )) ; then + echo "You need to specify the keyserver and at least one key identifier" + usage + exit 1 + fi + receive $* + ;; + trust) + if (( $# == 0 )) ; then + echo "You need to specify at least one key identifier" + usage + exit 1 + fi + while (( $# > 0 )) ; do + trust_key $1 + shift + done + ;; + adv*) + echo "Executing: ${GPG_PACMAN} $*" + ${GPG_PACMAN} $* || ret=$? + exit $ret + ;; + --help) + usage + ;; + --version) + echo "pacman-key v${PACMAN_KEY_VERSION}" + echo " This program can be freely distributed under the GPL v2" + ;; + *) + usage + exit 1 + ;; +esac diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in index 9b04be9..ad9b524 100644 --- a/scripts/repo-add.sh.in +++ b/scripts/repo-add.sh.in @@ -26,6 +26,8 @@ export TEXTDOMAINDIR='@localedir@' myver='@PACKAGE_VERSION@' confdir='@sysconfdir@' +GPG="gpg2" +SIG_EXT=".sig" QUIET=0 SIGN=0 @@ -62,8 +64,8 @@ error() { # print usage instructions usage() { printf "repo-add, repo-remove (pacman) %s\n\n" "$myver" - printf "$(gettext "Usage: repo-add [-q] [-s] [-v] <path-to-db> <package|delta> ...\n")" - printf "$(gettext "Usage: repo-remove [-q] <path-to-db> <packagename|delta> ...\n\n")" + printf "$(gettext "Usage: repo-add [-q] [-s [-k key]] [-v] <path-to-db> <package|delta> ...\n")" + printf "$(gettext "Usage: repo-remove [-q] [-s [-k key]] <path-to-db> <packagename|delta> ...\n\n")" printf "$(gettext "\ repo-add will update a package database by reading a package file.\n\ Multiple packages to add can be specified on the command line.\n\n")" @@ -185,13 +187,24 @@ create_signature() { local dbfile="$1" local ret=0 msg "$(gettext "Signing database...")" - if [ ! $(type -p "gpg") ]; then - error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")" + if [ ! $(type -p "${GPG}") ]; then + error "$(gettext "Cannot find the ${GPG} binary! Is gnupg installed?")" exit 1 # $E_MISSING_PROGRAM fi - gpg --detach-sign --use-agent "$dbfile" || ret=$? + + # Check if SIGNKEY is valid. + local SIGNWITHKEY="" + if [[ "${SIGNKEY}" ]]; then + if ! "${GPG}" --list-key "${SIGNKEY}" 1>/dev/null 2>&1; then + error "$(gettext "The key ${SIGNKEY} doesnn't exist.")" + exit 1 + fi + SIGNWITHKEY="-u ${SIGNKEY}" + fi + echo "${GPG} --detach-sign ${SIGNWITHKEY} $dbfile" + ${GPG} --detach-sign ${SIGNWITHKEY} "$dbfile" || ret=$? if (( ! ret )); then - msg2 "$(gettext "Created signature file %s.")" "$dbfile.sig" + msg2 "$(gettext "Created signature file %s.")" "${dbfile}${SIG_EXT}" else warning "$(gettext "Failed to sign package database.")" fi @@ -203,15 +216,15 @@ verify_signature() { local dbfile="$1" local ret=0 msg "$(gettext "Verifying database signature...")" - if [ ! $(type -p "gpg") ]; then - error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")" + if [ ! $(type -p "${GPG}") ]; then + error "$(gettext "Cannot find the ${GPG} binary! Is gnupg installed?")" exit 1 # $E_MISSING_PROGRAM fi - if [[ ! -f $dbfile.sig ]]; then + if [[ ! -f ${dbfile}${SIG_EXT} ]]; then warning "$(gettext "No existing signature found, skipping verification.")" return fi - gpg --verify "$dbfile.sig" || ret=$? + ${GPG} --verify "${dbfile}${SIG_EXT}" || ret=$? if (( ! ret )); then msg2 "$(gettext "Database signature file verified.")" else @@ -298,9 +311,9 @@ db_write_entry() echo -e "%MD5SUM%\n$md5sum\n" >>desc # add base64'd PGP signature - if [[ -f $startdir/$pkgfile.sig ]]; then + if [[ -f $startdir/$pkgfile${SIG_EXT} ]]; then echo -e "%PGPSIG%" >>desc - echo -e "$(openssl base64 -in "$startdir/$pkgfile.sig" | tr -d '\n')\n" >>desc + echo -e "$(openssl enc -base64 -in "$startdir/$pkgfile${SIG_EXT}")\n" >>desc fi [[ -n $url ]] && echo -e "%URL%\n$url\n" >>desc @@ -492,10 +505,24 @@ trap 'trap_exit "$(gettext "An unknown error has occured. Exiting...")"' ERR success=0 # parse arguments -for arg in "$@"; do +while [[ $# > 0 ]] ; do + arg="$1" case "$arg" in -q|--quiet) QUIET=1;; - -s|--sign) SIGN=1;; + -s|--sign) + SIGN=1 + # The signature will be made, even if there are no operations + success=1 + ;; + -k) + shift + SIGNKEY="$1" + # Check if key really exists + if ! ${GPG} --list-key ${SIGNKEY} 1> /dev/null 2>&1; then + error "$(gettext "Cannot find key $SIGNKEY.")" + exit 1 + fi + ;; -v|--verify) VERIFY=1;; *) if [[ -z $REPO_DB_FILE ]]; then @@ -510,6 +537,7 @@ for arg in "$@"; do fi ;; esac + shift done # if at least one operation was a success, re-zip database @@ -529,18 +557,19 @@ if (( success )); then cd "$tmpdir" if [[ -n $(ls) ]]; then bsdtar -c${TAR_OPT}f "$filename" * - create_signature "$filename" else # we have no packages remaining? zip up some emptyness warning "$(gettext "No packages remain, creating empty database.")" bsdtar -c${TAR_OPT}f "$filename" -T /dev/null fi + # The signature must be dealt with in both cases, empty repo or not. + create_signature "$filename" cd "$startdir" [[ -f $REPO_DB_FILE ]] && mv -f "$REPO_DB_FILE" "${REPO_DB_FILE}.old" - [[ -f $REPO_DB_FILE.sig ]] && rm -f "$REPO_DB_FILE.sig" + [[ -f $REPO_DB_FILE${SIG_EXT} ]] && rm -f "$REPO_DB_FILE${SIG_EXT}" [[ -f $tmpdir/$filename ]] && mv "$tmpdir/$filename" "$REPO_DB_FILE" - [[ -f $tmpdir/$filename.sig ]] && mv "$tmpdir/$filename.sig" "$REPO_DB_FILE.sig" + [[ -f $tmpdir/$filename${SIG_EXT} ]] && mv "$tmpdir/$filename${SIG_EXT}" "$REPO_DB_FILE${SIG_EXT}" ln -sf "$REPO_DB_FILE" "${REPO_DB_FILE%.tar.*}" else msg "$(gettext "No packages modified, nothing to do.")" -- 1.7.1

4 5

[pacman-dev] Patches for review - package signing
by Denis A. Altoé Falqueto 29 Jun '10

29 Jun '10

Guys, I'm proud to say that I've managed to reach an initial working implementation for the proposal for package and database signing, as formalized in the wiki. It works (in my tests, at least). These two patches are against the gpg branch from Allan's repository. They are not really in quality level to be merged, but I would appreciate any help in that direction. There are certainly problems of style, some bugs may be hidden, but it is a starting point for discussion over some real implementation. The commit descriptions are terse on purpose. I didn't worry about the messages, because the patches are really not finished and there would be a lot of things to say about the implementation. If everything builds correctly, a simple way to test it is to do the following: 1. create a key to sign keys (this is not really needed, but is in accordance to the current proposal) 2. if you don't have a key for yourself, create one 3. sign your key with the key signing key 4. export both keys to a file 5. as root, use the script pacman-key to import the keys to pacman's keyring with: $ sudo pacman-key add file 6. use pacman-key to trust the key signing key with: $ sudo pacman-key trust <key id> This will take you into the prompt of gpg2, which tells you about the fingerprint of the selected key and waits for you to type "trust" and press enter. After that you will need to trust the key ultimately. This is needed to make your key trusted too and I (as you) think this is not the ideal solution. Further research will be made to see if I'm using the wrong parameters in the verification phase. Let's move on for now. 7. now you need some packages to make a repository from. Your cache is a good candidate. You should copy them to a test location, so we can sign them as normal users (as the root user don't have access to your default keyring). 8. sign the packages with: $ for i in *.pkg.tar.*z ; do gpg2 --detach-sign ${i} ; done 9. you can test the makepkg signing too, by having a copy of the makepkg.conf file and adding sign to the buildenv array. 10. if you want, build a new package with the test makepkg script. You should see the prompt for the password (if it is not cached from the last step) and the end result is the package and signature files. Move them to the repository directory. 11. create the repository with: $ repo-add -s <repo-name>.db.tar.gz *.pkg.tar.*z 12. you can copy the test pacman binary to the repository and su - to make it more convenient for the next steps 13. create a copy of pacman.conf to add a new repository and enable the signature on it with: [repo-name] Server = file:///directory-of-your-repo VerifSig = Always There are three options for VerifSig: Always, Optional and None. The pacman.conf file should point to a temporary RootDir, DBPath, CacheDir and LogFile, so you'll not mess up your system. 14. now is the time: pacman -Sy will download the repository database and check if it is signed and if the signature is trusted. 15. pacman -S <some package> will "download" and check the signatures in the process of validating the files. The message for a invalid signature is not ideal. It is as if the package were corrupted, which is not necessarily the case. Well, that's it for now. Any suggestions, questions and critics are very much appreciated and needed. PS: I'm resending this email, as the first had problems with the size of the patch. The patch had some bugs too, which I've corrected now. -- A: Because it obfuscates the reading. Q: Why is top posting so bad? ------------------------------------------- Denis A. Altoe Falqueto -------------------------------------------

2 3

[pacman-dev] [PATCH 01/10] makepkg: undeclared local variables
by Andres P 28 Jun '10

28 Jun '10

Variables that are only meaningful within the function they are declared in are now prefixed by "local". Signed-off-by: Andres P <aepd87(a)gmail.com> --- scripts/makepkg.sh.in | 29 +++++++++++++++++++++-------- 1 files changed, 21 insertions(+), 8 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index cbc344d..07fc6d5 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -135,6 +135,9 @@ clean_up() { fi if (( ! EXIT_CODE && CLEANUP )); then + local pkg + local file + # If it's a clean exit and -c/--clean has been passed... msg "$(gettext "Cleaning up...")" rm -rf "$pkgdir" "$srcdir" @@ -308,7 +311,7 @@ get_downloadclient() { for i in "${DLAGENTS[@]}"; do local handler="${i%%::*}" if [[ $proto = $handler ]]; then - agent="${i##*::}" + local agent="${i##*::}" break fi done @@ -388,6 +391,7 @@ check_deps() { # Also, a non-zero return value is not unexpected and we are manually dealing them set +E local ret=0 + local pmout pmout=$(run_pacman -T "$@") || ret=$? set -E @@ -655,7 +659,7 @@ extract_sources() { msg "$(gettext "Extracting Sources...")" local netfile for netfile in "${source[@]}"; do - file=$(get_filename "$netfile") + local file=$(get_filename "$netfile") if in_array "$file" ${noextract[@]}; then #skip source files in the noextract=() array # these are marked explicitly to NOT be extracted @@ -731,7 +735,7 @@ run_function() { if [[ -z $1 ]]; then return 1 fi - pkgfunc="$1" + local pkgfunc="$1" # clear user-specified makeflags if requested if [[ $(check_option makeflags) = "n" ]]; then @@ -747,8 +751,9 @@ run_function() { local shellopts=$(shopt -p) local ret=0 + local restoretrap if (( LOGGING )); then - BUILDLOG="${startdir}/${pkgbase}-${pkgver}-${pkgrel}-${CARCH}-$pkgfunc.log" + local BUILDLOG="${startdir}/${pkgbase}-${pkgver}-${pkgrel}-${CARCH}-$pkgfunc.log" if [[ -f $BUILDLOG ]]; then local i=1 while true; do @@ -803,6 +808,7 @@ run_build() { } run_package() { + local pkgfunc if [[ -z $1 ]]; then pkgfunc="package" else @@ -936,6 +942,7 @@ write_pkginfo() { [[ $provides ]] && printf "provides = %s\n" "${provides[@]}" [[ $backup ]] && printf "backup = %s\n" "${backup[@]}" + local it for it in "${packaging_options[@]}"; do local ret="$(check_option $it)" if [[ $ret != "?" ]]; then @@ -984,6 +991,7 @@ create_package() { cd "$pkgdir" msg "$(gettext "Creating package...")" + local nameofpkg if [[ -z $1 ]]; then nameofpkg="$pkgname" else @@ -1019,6 +1027,7 @@ create_package() { # tar it up msg2 "$(gettext "Compressing package...")" + local EXT case "$PKGEXT" in *tar.gz) EXT=${PKGEXT%.gz} ;; *tar.bz2) EXT=${PKGEXT%.bz2} ;; @@ -1153,7 +1162,7 @@ install_package() { msg "$(gettext "Installing %s package group with %s -U...")" "$pkgbase" "$PACMAN" fi - local pkglist + local pkg pkglist for pkg in ${pkgname[@]}; do if [[ -f $PKGDEST/${pkg}-${pkgver}-${pkgrel}-${CARCH}${PKGEXT} ]]; then pkglist+=" $PKGDEST/${pkg}-${pkgver}-${pkgrel}-${CARCH}${PKGEXT}" @@ -1228,7 +1237,7 @@ check_sanity() { local optdepend for optdepend in "${optdepends[@]}"; do - pkg=${optdepend%%:*} + local pkg=${optdepend%%:*} if [[ ! $pkg =~ ^[[:alnum:]\>\<\=\.\+\_\-]*$ ]]; then error "$(gettext "Invalid syntax for optdepend : '%s'")" "$optdepend" fi @@ -1267,6 +1276,7 @@ check_sanity() { return 1 fi + local pkg if (( ${#pkgname[@]} > 1 )); then for pkg in ${pkgname[@]}; do if ! declare -f package_${pkg} >/dev/null; then @@ -1373,15 +1383,17 @@ devel_update() { } backup_package_variables() { + local var for var in ${splitpkg_overrides[@]}; do - indirect="${var}_backup" + local indirect="${var}_backup" eval "${indirect}=(\"\${$var[@]}\")" done } restore_package_variables() { + local var for var in ${splitpkg_overrides[@]}; do - indirect="${var}_backup" + local indirect="${var}_backup" if [[ -n ${!indirect} ]]; then eval "${var}=(\"\${$indirect[@]}\")" else @@ -1410,6 +1422,7 @@ parse_options() { local long_options=$1; shift; local ret=0; local unused_options="" + local i while [[ -n $1 ]]; do if [[ ${1:0:2} = '--' ]]; then -- 1.7.1

2 11

[pacman-dev] [PATCH] Do not compare signed and unsigned types
by Allan McRae 28 Jun '10

28 Jun '10

The casting of nread is safe as it is tested to be >0 when it is initally assigned. It is also being implicitly case in the fwrite call in the line above. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/dload.c | 2 +- src/pacman/pacman.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index c11148d..3185d2a 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -251,7 +251,7 @@ static int download_internal(const char *url, const char *localpath, check_stop(); size_t nwritten = 0; nwritten = fwrite(buffer, 1, nread, localf); - if((nwritten != nread) || ferror(localf)) { + if((nwritten != (size_t)nread) || ferror(localf)) { pm_errno = PM_ERR_RETRIEVE; _alpm_log(PM_LOG_ERROR, _("error writing to file '%s': %s\n"), tempfile, strerror(errno)); diff --git a/src/pacman/pacman.c b/src/pacman/pacman.c index ecc37c9..60f2e5e 100644 --- a/src/pacman/pacman.c +++ b/src/pacman/pacman.c @@ -1002,7 +1002,7 @@ static int _parseconfig(const char *file, const char *givensection, file, linenum, value); break; default: - for(int gindex = 0; gindex < globbuf.gl_pathc; gindex++) { + for(size_t gindex = 0; gindex < globbuf.gl_pathc; gindex++) { pm_printf(PM_LOG_DEBUG, "config file %s, line %d: including %s\n", file, linenum, globbuf.gl_pathv[gindex]); _parseconfig(globbuf.gl_pathv[gindex], section, db); -- 1.7.1

1 0

[pacman-dev] [PATCH] makepkg: Only check regular files in $srcdir check
by Thomas Bächler 28 Jun '10

28 Jun '10

The 'grep -R' in the $srcdir check would not only grep regular files, but also devices, symlinks (that might potentially point outside of $pkgdir), pipes and so on. Use find to ensure only regular files are examined. This should fix https://bugs.archlinux.org/task/19975 --- I haven't tested this yet (no time right now), but this should work and fix the bug. Please review and comment, I may be able to test it later. scripts/makepkg.sh.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in index cbc344d..97bf5da 100644 --- a/scripts/makepkg.sh.in +++ b/scripts/makepkg.sh.in @@ -967,7 +967,7 @@ check_package() { done # check for references to the build directory - if grep -R "${srcdir}" "${pkgdir}" &>/dev/null; then + if find "${pkgdir}" -type f -exec grep -q "${srcdir}" {} +; then warning "$(gettext "Package contains reference to %s")" "\$srcdir" fi } -- 1.7.1

2 1

[pacman-dev] Dealing with asprintf failures
by Allan McRae 27 Jun '10

27 Jun '10

The remaining warnings generated with -D_FORTIFY_SOURCE=2 are usages of asprintf in src/pacman/util.c. e.g. util.c: In function ‘display_targets’: util.c:533:12: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result What is the best way to deal with these? One idea is: - asprintf(&str, "%s-%s [%.2f MB]", alpm_pkg_get_name(pkg), - alpm_pkg_get_version(pkg), mbsize); + if(asprintf(&str, "%s-%s [%.2f MB]", alpm_pkg_get_name(pkg), + alpm_pkg_get_version(pkg), mbsize) == -1) { + pm_fprintf(stderr, PM_LOG_ERROR, _("failed to allocate string\n")); + } This prints an error, but does not actually bail, on failure of asprintf. This is an improvement over the current code as we would know where the error occurred, but feels wrong not to exit. Note that several of the functions affected return void, so erroring out is not a simple "return -1". So, any ideas on the best way to approach this? Allan

3 10

[pacman-dev] [PATCH] Check return value of fgets calls
by Allan McRae 27 Jun '10

27 Jun '10

Prevents compiler warnings with -D_FORTIFY_SOURCE=2 Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/be_files.c | 8 ++++++-- lib/libalpm/trans.c | 3 +-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/libalpm/be_files.c b/lib/libalpm/be_files.c index c26bef2..e2bbe28 100644 --- a/lib/libalpm/be_files.c +++ b/lib/libalpm/be_files.c @@ -657,7 +657,9 @@ int _alpm_db_read(pmdb_t *db, pmpkg_t *info, pmdbinfrq_t inforeq) goto error; } while(!feof(fp)) { - fgets(line, 255, fp); + if(fgets(line, 256, fp) == NULL) { + break; + } _alpm_strtrim(line); if(strcmp(line, "%DEPENDS%") == 0) { while(fgets(line, sline, fp) && strlen(_alpm_strtrim(line))) { @@ -693,7 +695,9 @@ int _alpm_db_read(pmdb_t *db, pmpkg_t *info, pmdbinfrq_t inforeq) snprintf(path, PATH_MAX, "%sdeltas", pkgpath); if((fp = fopen(path, "r"))) { while(!feof(fp)) { - fgets(line, 255, fp); + if(fgets(line, 256, fp) == NULL) { + break; + } _alpm_strtrim(line); if(strcmp(line, "%DELTAS%") == 0) { while(fgets(line, sline, fp) && strlen(_alpm_strtrim(line))) { diff --git a/lib/libalpm/trans.c b/lib/libalpm/trans.c index c042f09..6ebfa8f 100644 --- a/lib/libalpm/trans.c +++ b/lib/libalpm/trans.c @@ -324,8 +324,7 @@ static int grep(const char *fn, const char *needle) while(!feof(fp)) { char line[1024]; int sline = sizeof(line)-1; - fgets(line, sline, fp); - if(feof(fp)) { + if(fgets(line, sline, fp) == NULL || feof(fp)) { continue; } if(strstr(line, needle)) { -- 1.7.1

2 2

[pacman-dev] [PATCH] Check return value of fwrite when copying files
by Allan McRae 27 Jun '10

27 Jun '10

Check that writing to destination file actually occurs in _alpm_copyfile. Required adding a new error (PM_ERR_WRITE) as none of the others appeared appropriate. Prevents compiler warning when using -D_FORTIFY_SOURCE=2. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/alpm.h | 1 + lib/libalpm/util.c | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 3329132..0c01f21 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -522,6 +522,7 @@ enum _pmerrno_t { PM_ERR_FILE_CONFLICTS, /* Misc */ PM_ERR_RETRIEVE, + PM_ERR_WRITE, PM_ERR_INVALID_REGEX, /* External library errors */ PM_ERR_LIBARCHIVE, diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index 383568c..559d62e 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -143,7 +143,15 @@ int _alpm_copyfile(const char *src, const char *dest) /* do the actual file copy */ while((len = fread(buf, 1, CPBUFSIZE, in))) { - fwrite(buf, 1, len, out); + size_t nwritten = 0; + nwritten = fwrite(buf, 1, len, out); + if((nwritten != len) || ferror(out)) { + pm_errno = PM_ERR_WRITE; + _alpm_log(PM_LOG_ERROR, _("error writing to file '%s': %s\n"), + dest, strerror(errno)); + ret = -1; + goto cleanup; + } } /* chmod dest to permissions of src, as long as it is not a symlink */ -- 1.7.1

1 0

Re: [pacman-dev] [PATCH] redirect scriptlet stderr through alpm
by Jonathan Conder 24 Jun '10

24 Jun '10

Sorry, I forgot to rebase against master. Here's the real patch: Fixes FS#18770, and hopefully an occasional deadlock in my frontend as well. For simplicity it redirects all scriptlet output through SCRIPTLET_INFO, and all callbacks in the child process have been replaced for thread-safety. Signed-off-by: Jonathan Conder <j(a)skurvy.no-ip.org> --- lib/libalpm/util.c | 86 +++++++++++++++++++++++++++++---------------------- 1 files changed, 49 insertions(+), 37 deletions(-) diff --git a/lib/libalpm/util.c b/lib/libalpm/util.c index 32eaa44..62851c1 100644 --- a/lib/libalpm/util.c +++ b/lib/libalpm/util.c @@ -448,6 +448,7 @@ int _alpm_run_chroot(const char *root, const char *cmd) { char cwd[PATH_MAX]; pid_t pid; + int pipefd[2]; int restore_cwd = 0; int retval = 0; @@ -471,6 +472,12 @@ int _alpm_run_chroot(const char *root, const char *cmd) /* Flush open fds before fork() to avoid cloning buffers */ fflush(NULL); + if(pipe(pipefd) == -1) { + _alpm_log(PM_LOG_ERROR, _("could not create pipe (%s)\n"), strerror(errno)); + retval = 1; + goto cleanup; + } + /* fork- parent and child each have seperate code blocks below */ pid = fork(); if(pid == -1) { @@ -480,55 +487,60 @@ int _alpm_run_chroot(const char *root, const char *cmd) } if(pid == 0) { - FILE *pipe; /* this code runs for the child only (the actual chroot/exec) */ - _alpm_log(PM_LOG_DEBUG, "chrooting in %s\n", root); + close(1); + close(2); + close(pipefd[0]); + while(dup2(pipefd[1], 1) == -1 && errno == EINTR); + while(dup2(pipefd[1], 2) == -1 && errno == EINTR); + close(pipefd[1]); + if(chroot(root) != 0) { - _alpm_log(PM_LOG_ERROR, _("could not change the root directory (%s)\n"), - strerror(errno)); + printf(_("could not change the root directory (%s)\n"), strerror(errno)); exit(1); } if(chdir("/") != 0) { - _alpm_log(PM_LOG_ERROR, _("could not change directory to / (%s)\n"), - strerror(errno)); + printf(_("could not change directory to / (%s)\n"), strerror(errno)); exit(1); } umask(0022); - pipe = popen(cmd, "r"); - if(!pipe) { - _alpm_log(PM_LOG_ERROR, _("call to popen failed (%s)\n"), - strerror(errno)); - exit(1); - } - while(!feof(pipe)) { - char line[PATH_MAX]; - if(fgets(line, PATH_MAX, pipe) == NULL) - break; - alpm_logaction("%s", line); - EVENT(handle->trans, PM_TRANS_EVT_SCRIPTLET_INFO, line, NULL); - } - retval = pclose(pipe); - exit(WEXITSTATUS(retval)); + execl("/bin/sh", "sh", "-c", cmd, (char *) NULL); + printf(_("call to execl failed (%s)\n"), strerror(errno)); + exit(1); } else { /* this code runs for the parent only (wait on the child) */ - pid_t retpid; int status; - do { - retpid = waitpid(pid, &status, 0); - } while(retpid == -1 && errno == EINTR); - if(retpid == -1) { - _alpm_log(PM_LOG_ERROR, _("call to waitpid failed (%s)\n"), - strerror(errno)); - retval = 1; - goto cleanup; + FILE *pipe; + + close(pipefd[1]); + pipe = fdopen(pipefd[0], "r"); + if(pipe == NULL) { + close(pipefd[0]); } else { - /* check the return status, make sure it is 0 (success) */ - if(WIFEXITED(status)) { - _alpm_log(PM_LOG_DEBUG, "call to waitpid succeeded\n"); - if(WEXITSTATUS(status) != 0) { - _alpm_log(PM_LOG_ERROR, _("command failed to execute correctly\n")); - retval = 1; - } + while(!feof(pipe)) { + char line[PATH_MAX]; + if(fgets(line, PATH_MAX, pipe) == NULL) + break; + alpm_logaction("%s", line); + EVENT(handle->trans, PM_TRANS_EVT_SCRIPTLET_INFO, line, NULL); + } + fclose(pipe); + } + + while(waitpid(pid, &status, 0) == -1) { + if(errno != EINTR) { + _alpm_log(PM_LOG_ERROR, _("call to waitpid failed (%s)\n"), strerror(errno)); + retval = 1; + goto cleanup; + } + } + + /* check the return status, make sure it is 0 (success) */ + if(WIFEXITED(status)) { + _alpm_log(PM_LOG_DEBUG, "call to waitpid succeeded\n"); + if(WEXITSTATUS(status) != 0) { + _alpm_log(PM_LOG_ERROR, _("command failed to execute correctly\n")); + retval = 1; } } } -- 1.7.1

3 10