- Pacman-dev - lists.archlinux.org

[pacman-dev] New patchset for package signing
by Denis A. Altoé Falqueto 25 Nov '10

25 Nov '10

So, I changed the code to use gpgme. Here are the patches for your evaluation. By the way, I'm not {angry,upset,crying} :) I really want to see package signing in pacman, but I know that this is a complex issue that will need lots of discussion. Below, follows a little explanation of the general idea of each patch. [PATCH 1/5] pacman-key: keyring management tool The script that helps with management for pacman keyring. It uses gpg, instead of gpg2 and is heavly inpired on apt-key, from debian. It is very straightforward. [PATCH 2/5] Signature verification functions Two functions: one for signatures in memory and another for signatures in files. Signatures of packages are stored in the repository and are copied to memory before verification. The signatures of database files are stored on files, hence the new function. [PATCH 3/5] Verify the signatures of databases and packages The calls for the signature functions. Verification of database updates and package instalations from the repositories. I didn't worry about local instalations, but it doesn't mean they are not there. If it were verified before (as Dan suggests), they are there. :) A point raised by Dan was that the reading of the signature from the repository was too complex. The reaasoning behind it is that signatures grow according to the size of the key used to sign. So, we can't be never sure if some buffer size is really enough. Maybe it is enough now, but in the future it may be not and we'll have a new bug in the bugtracker. My implementation is simple and robust, so it will work with any signature size. [PATCH 4/5] Parameter to select key to sign Just a new parameter to allow the packager to select the key he wants to use. if the key is not specified, his default key will be used. [PATCH 5/5] Document new options related to package signing Just documentation. No imporant comment. As always, comments and suggestions are welcome. -- Denis A. Altoé Falqueto

7 34

[pacman-dev] (Locally) signing a key with pacman-key?
by Allan McRae 24 Nov '10

24 Nov '10

Hi, While playing around with package/database signing, I noticed that I could only validate my packages if I imported my key with pacman-key and then gave it "ultimate" trust. Setting "high" trust allows the signing to be verified but with an unknown trust level. So it seems to me that we always need (at least) one key with ultimate trust in our pacman keyring. I am still confirming my understanding of this on the gpg mailing list so feel free to correct me if I am completely wrong! So, the procedure for someone to use a signed repo would be either: 1) Import the key for a signed repo (which may be used to sign other keys for that repo) and give it "ultimate" trust. While giving ultimate trust to a key that is not yours may be a bit strange, it is only ultimate trust as fas as the pacman keyring goes so may be acceptable... 2) Have your personal key in the pacman keyring with "ultimate" trust. Import the key for the signed repo and locally sign it with your key. If that key is a "master key" that signs other keys used in the signed repo, then we need to give it a trust level (probably full...). I think both methods have their pros and cons. It should be up to the user to decide which they use. The second method has the advantage that you have to explicitly give the key a trust level so importing a key for a repo does not allow that key to be used to install a package adding a bunch of new keys which have been signed by it. It has the disadvantage that you would have to import your secret key into pacman's keyring... If people think the second method is reasonable, it would be good to add an option to pacman-key to allow signing (locally only) of keys. Discuss! Allan

2 4

[pacman-dev] [PATCH] Add SCMs to DLAGENTS
by David Campbell 24 Nov '10

24 Nov '10

Treat source control management programs like they are download agents. Specify what %o and %u mean so that users can meaningfully modify how they want different SCMs to behave. --- etc/makepkg.conf.in | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/etc/makepkg.conf.in b/etc/makepkg.conf.in index f0d1c44..6636e17 100644 --- a/etc/makepkg.conf.in +++ b/etc/makepkg.conf.in @@ -8,11 +8,18 @@ # #-- The download utilities that makepkg should use to acquire sources # Format: 'protocol::agent' +# Variables: %u = url, %o = filename DLAGENTS=('ftp::/usr/bin/wget -c --passive-ftp -t 3 --waitretry=3 -O %o %u' 'http::/usr/bin/wget -c -t 3 --waitretry=3 -O %o %u' 'https::/usr/bin/wget -c -t 3 --waitretry=3 --no-check-certificate -O %o %u' 'rsync::/usr/bin/rsync -z %u %o' - 'scp::/usr/bin/scp -C %u %o') + 'scp::/usr/bin/scp -C %u %o' + 'darcs::/usr/bin/darcs get --partial --set-scripts-executablei %u' + 'cvs::/usr/bin/cvs -z3 %u co -D $pkgver -f %o' + 'git::/usr/bin/git clone %u %o' + 'svn::/usr/bin/svn co %u --config-dir ./ -r $pkgver %o' + 'bzr::' + 'hg::/usr/bin/hg clone %u %o') # Other common tools: # /usr/bin/snarf -- 1.7.3.1

2 2

[pacman-dev] Status of package signing work
by Allan McRae 23 Nov '10

23 Nov '10

Hi, I just rebased the gpg work on top of my working branch and pulled in a couple of patches to do with the pacman-key tool so I thought it would be a good time to get a summary of where we are on this. Here is my take on the current status. I would like to keep this list up-to-date so we can track progress, so feel free to reply adding anything I have missed. pacman-key: - tool to manage pacman keyring - TODO: man page needs tidying/clarification makepkg: - will sign packages and produce detached signature if the "sign" option is enabled in makepkg.conf - split packages, PKGDEST etc all handled - TODO: allow selection of key used for signing (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011435.html) - TODO: documentation (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011436.html) repo-add: - adds package signature (base64) to repos if available when adding package - has option to sign a repo after creation and verify current signature before making changes - TODO: check signature used to verify is not only good but is also in a list of accepted keys (???) - TODO: allow selection of key used for signing (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011435.html) - TODO: documentation (patch: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011436.html) pacman: - reads in keys from repo-db and decodes them when needed - reads in .sig files when beside a package being loaded from the filesystem - integrated gpgme into pacman for signature verification - provide options to control signature verification on a per repo basis - verifies signatures of packages when installing from repo - TODO: create directories needed for keyring during "make install" - TODO: verify signatures for packages installed from filesystem (???) - TODO: download and verify signatures of dbs (patches: http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011433.html http://mailman.archlinux.org/pipermail/pacman-dev/2010-July/011434.html) I think the very last TODO there is the only thing stopping us from getting some actual testing of this work underway. I think I have my head around what the two patches are doing now, but I am not sure I like the "how" of that doing. So I will make an attempt into hacking them as I see fit in the next few days... Then I will publish a signed repo with a pacman-git and we can see how this all goes! Allan

2 5

[pacman-dev] makepkg: gpg signature verification?
by Florian Pritz 23 Nov '10

23 Nov '10

I'd like to add $gpgsource (urls to gpg signatures of the sources) to PKGBUILDs and when building check the signatures, but I'm not sure what to do when the check fails. If the user doesn't have the key in his keyring or doesn't trust it my idea would be to display an error message and exit, but that doesn't seem practical although I think it's the right way. I also have no idea how to handle chroots. I really can't expect users to copy their keyring into the chroot, but I could add an option to makepkg.conf so you can disable the checking and wrapper scripts could then do that before chrooting (using a new --verify option maybe). C&C please. -- Florian Pritz -- {flo,bluewind}(a)server-speed.net

2 1

[pacman-dev] [PATCH 2/2] Download and verify package database signatures
by Allan McRae 22 Nov '10

22 Nov '10

If signature verification is needed, attempt to download a signature file for a repo when it is updated. Return an error if unable to download signature only when checking is mandatory, or if signature is invalid. TODO: At the moment the database signature is only checked on download. Should we do anything with a database if it fails to be verified to prevent its future usage? Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/be_sync.c | 41 ++++++++++++++++++++++++++++++++++++----- 1 files changed, 36 insertions(+), 5 deletions(-) diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c index d3399b2..1cf6727 100644 --- a/lib/libalpm/be_sync.c +++ b/lib/libalpm/be_sync.c @@ -104,23 +104,54 @@ int SYMEXPORT alpm_db_update(int force, pmdb_t *db) sprintf(syncpath, "%s%s", dbpath, "sync/"); ret = _alpm_download_single_file(dbfile, db->servers, syncpath, force); - free(dbfile); - free(syncpath); if(ret == 1) { /* files match, do nothing */ pm_errno = 0; - return(1); + goto cleanup; } else if(ret == -1) { /* pm_errno was set by the download code */ _alpm_log(PM_LOG_DEBUG, "failed to sync db: %s\n", alpm_strerrorlast()); - return(-1); + goto cleanup; + } + + /* Download and check the signature of the database if needed */ + if(db->pgp_verify != PM_PGP_VERIFY_NEVER) { + char *sigfile; + int sigret; + + len = strlen(dbfile) + 5; + MALLOC(sigfile, len, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(sigfile, "%s.sig", dbfile); + + sigret = _alpm_download_single_file(sigfile, db->servers, syncpath, 1); + free(sigfile); + + if(sigret == -1 && db->pgp_verify == PM_PGP_VERIFY_ALWAYS) { + _alpm_log(PM_LOG_ERROR, _("Failed to download signature for db: %s\n"), + alpm_strerrorlast()); + pm_errno = PM_ERR_SIG_INVALID; + ret = -1; + goto cleanup; + } + + sigret = alpm_db_check_pgp_signature(db); + if((db->pgp_verify == PM_PGP_VERIFY_ALWAYS && sigret != 0) || + (db->pgp_verify == PM_PGP_VERIFY_OPTIONAL && sigret == 1)) { + /* pm_errno was set by the checking code */ + /* TODO: should we just leave the unverified database */ + ret = -1; + goto cleanup; + } } /* Cache needs to be rebuilt */ _alpm_db_free_pkgcache(db); - return(0); +cleanup: + free(dbfile); + free(syncpath); + return(ret); } int _alpm_sync_db_populate(pmdb_t *db) -- 1.7.3.2

1 0

[pacman-dev] [PATCH 1/2] Add functions for verifying db signature
by Allan McRae 22 Nov '10

22 Nov '10

Add a pmpgpsig_t struct to the database entry struct and functions for the lazy loading of database signatures. Add a function for checking database signatures, reusing (and generalizing) the code currently used for checking package signatures. TODO: The code for reading in signature files from the filesystem is duplicated for local packages and database and needs refactored. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- lib/libalpm/alpm.h | 1 + lib/libalpm/db.c | 56 +++++++++++++++++++++++++++++++++++++++++++++ lib/libalpm/db.h | 7 +++++- lib/libalpm/package.h | 11 +-------- lib/libalpm/signing.c | 61 ++++++++++++++++++++++++++++++------------------ lib/libalpm/signing.h | 12 +++++++++- 6 files changed, 113 insertions(+), 35 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index 9dd222d..74598ef 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -253,6 +253,7 @@ alpm_list_t *alpm_pkg_unused_deltas(pmpkg_t *pkg); */ int alpm_pkg_check_pgp_signature(pmpkg_t *pkg); +int alpm_db_check_pgp_signature(pmdb_t *db); /* GPG signature verification option */ typedef enum _pgp_verify_t { diff --git a/lib/libalpm/db.c b/lib/libalpm/db.c index 9fd918a..a7718d5 100644 --- a/lib/libalpm/db.c +++ b/lib/libalpm/db.c @@ -409,6 +409,62 @@ pmdb_t *_alpm_db_new(const char *treename, int is_local) return(db); } +static int load_pgpsig(pmdb_t *db) { + size_t len; + const char *dbfile; + char *sigfile; + + dbfile = _alpm_db_path(db); + len = strlen(dbfile) + 5; + MALLOC(sigfile, len, RET_ERR(PM_ERR_MEMORY, -1)); + sprintf(sigfile, "%s.sig", dbfile); + + if(access(sigfile, R_OK) == 0) { + FILE *f; + long bytes; + size_t bytes_read; + f = fopen(sigfile, "rb"); + fseek(f, 0L, SEEK_END); + bytes = ftell(f); + fseek(f, 0L, SEEK_SET); + CALLOC(db->pgpsig.rawdata, bytes, sizeof(char), + goto error); + bytes_read = fread(db->pgpsig.rawdata, sizeof(char), bytes, f); + if(bytes_read == bytes) { + db->pgpsig.rawlen = bytes; + _alpm_log(PM_LOG_DEBUG, + "loaded database .sig file, location %s\n", sigfile); + } else { + _alpm_log(PM_LOG_WARNING, _("Failed reading PGP signature file for %s"), + dbfile); + } + fclose(f); + } else { + _alpm_log(PM_LOG_DEBUG, "no database signature file found\n"); + } + + return(0); + +error: + FREE(db->pgpsig.rawdata); + db->pgpsig.rawlen = 0; + return(1); +} + +const pmpgpsig_t *_alpm_db_pgpsig(pmdb_t *db) +{ + ALPM_LOG_FUNC; + + /* Sanity checks */ + ASSERT(db != NULL, return(NULL)); + + if(db->pgpsig.rawdata == NULL) { + load_pgpsig(db); + } + + return &(db->pgpsig); +} + void _alpm_db_free(pmdb_t *db) { ALPM_LOG_FUNC; diff --git a/lib/libalpm/db.h b/lib/libalpm/db.h index ab896b9..1372b0d 100644 --- a/lib/libalpm/db.h +++ b/lib/libalpm/db.h @@ -22,7 +22,6 @@ #ifndef _ALPM_DB_H #define _ALPM_DB_H -#include "alpm.h" #include <limits.h> #include <time.h> @@ -30,6 +29,9 @@ #include <archive.h> #include <archive_entry.h> +#include "alpm.h" +#include "signing.h" + /* Database entries */ typedef enum _pmdbinfrq_t { INFRQ_BASE = 1, @@ -58,6 +60,8 @@ struct __pmdb_t { alpm_list_t *pkgcache; alpm_list_t *grpcache; alpm_list_t *servers; + /* do not access directly, use _alpm_db_pgpsig(db) for lazy access */ + pmpgpsig_t pgpsig; pgp_verify_t pgp_verify; struct db_operations *ops; @@ -73,6 +77,7 @@ pmdb_t *_alpm_db_register_local(void); pmdb_t *_alpm_db_register_sync(const char *treename); void _alpm_db_unregister(pmdb_t *db); pmdb_t *_alpm_db_new(const char *treename, int is_local); +const pmpgpsig_t *_alpm_db_pgpsig(pmdb_t *db); /* be_*.c, backend specific calls */ int _alpm_local_db_populate(pmdb_t *db); diff --git a/lib/libalpm/package.h b/lib/libalpm/package.h index be5ce32..7c11e38 100644 --- a/lib/libalpm/package.h +++ b/lib/libalpm/package.h @@ -29,6 +29,7 @@ #include "alpm.h" #include "db.h" +#include "signing.h" typedef enum _pmpkgfrom_t { PKG_FROM_FILE = 1, @@ -90,16 +91,6 @@ struct pkg_operations { */ extern struct pkg_operations default_pkg_ops; -struct __pmpgpsig_t { - /* we will either store the encoded data or the raw data- - * this way we can decode on an as-needed basis since most - * operations won't require the overhead of base64 decodes - * on all packages in a sync repository. */ - char *encdata; - size_t rawlen; - unsigned char *rawdata; -}; - struct __pmpkg_t { char *filename; char *name; diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index 2b15528..826c34b 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -92,28 +92,28 @@ error: } /** - * Check the PGP package signature for the given package file. - * @param pkgpath the full path to a package file + * Check the PGP package signature for the given file. + * @param path the full path to a file * @param sig PGP signature data in raw form (already decoded) * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) */ -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) +int _alpm_gpgme_checksig(const char *path, const pmpgpsig_t *sig) { int ret = 0; gpgme_error_t err; gpgme_ctx_t ctx; - gpgme_data_t pkgdata, sigdata; + gpgme_data_t filedata, sigdata; gpgme_verify_result_t result; gpgme_signature_t gpgsig; - FILE *pkgfile = NULL, *sigfile = NULL; + FILE *file = NULL, *sigfile = NULL; ALPM_LOG_FUNC; if(!sig || !sig->rawdata) { RET_ERR(PM_ERR_SIG_UNKNOWN, -1); } - if(!pkgpath || access(pkgpath, R_OK) != 0) { - RET_ERR(PM_ERR_PKG_NOT_FOUND, -1); + if(!path || access(path, R_OK) != 0) { + RET_ERR(PM_ERR_NOT_A_FILE, -1); } if(gpgme_init()) { /* pm_errno was set in gpgme_init() */ @@ -124,13 +124,13 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) /* create our necessary data objects to verify the signature */ /* first the package itself */ - pkgfile = fopen(pkgpath, "rb"); - if(pkgfile == NULL) { - pm_errno = PM_ERR_PKG_OPEN; + file = fopen(path, "rb"); + if(file == NULL) { + pm_errno = PM_ERR_NOT_A_FILE; ret = -1; goto error; } - err = gpgme_data_new_from_stream(&pkgdata, pkgfile); + err = gpgme_data_new_from_stream(&filedata, file); CHECK_ERR(); /* next create data object for the signature */ @@ -138,7 +138,7 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) CHECK_ERR(); /* here's where the magic happens */ - err = gpgme_op_verify(ctx, sigdata, pkgdata, NULL); + err = gpgme_op_verify(ctx, sigdata, filedata, NULL); CHECK_ERR(); result = gpgme_op_verify_result(ctx); gpgsig = result->signatures; @@ -161,34 +161,34 @@ int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig) if(gpgsig->summary & GPGME_SIGSUM_VALID) { /* good signature, continue */ - _alpm_log(PM_LOG_DEBUG, _("Package %s has a valid signature.\n"), - pkgpath); + _alpm_log(PM_LOG_DEBUG, _("File %s has a valid signature.\n"), + path); } else if(gpgsig->summary & GPGME_SIGSUM_GREEN) { /* 'green' signature, not sure what to do here */ - _alpm_log(PM_LOG_WARNING, _("Package %s has a green signature.\n"), - pkgpath); + _alpm_log(PM_LOG_WARNING, _("File %s has a green signature.\n"), + path); } else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) { pm_errno = PM_ERR_SIG_UNKNOWN; - _alpm_log(PM_LOG_WARNING, _("Package %s has a signature from an unknown key.\n"), - pkgpath); + _alpm_log(PM_LOG_WARNING, _("File %s has a signature from an unknown key.\n"), + path); ret = -1; } else { /* we'll capture everything else here */ pm_errno = PM_ERR_SIG_INVALID; - _alpm_log(PM_LOG_ERROR, _("Package %s has an invalid signature.\n"), - pkgpath); + _alpm_log(PM_LOG_ERROR, _("File %s has an invalid signature.\n"), + path); ret = 1; } error: gpgme_data_release(sigdata); - gpgme_data_release(pkgdata); + gpgme_data_release(filedata); gpgme_release(ctx); if(sigfile) { fclose(sigfile); } - if(pkgfile) { - fclose(pkgfile); + if(file) { + fclose(file); } if(err != GPG_ERR_NO_ERROR) { _alpm_log(PM_LOG_ERROR, _("GPGME error: %s\n"), gpgme_strerror(err)); @@ -211,4 +211,19 @@ int SYMEXPORT alpm_pkg_check_pgp_signature(pmpkg_t *pkg) alpm_pkg_get_pgpsig(pkg))); } +/** + * Check the PGP package signature for the given database. + * @param db the database to check + * @return a int value : 0 (valid), 1 (invalid), -1 (an error occured) + */ +int SYMEXPORT alpm_db_check_pgp_signature(pmdb_t *db) +{ + ALPM_LOG_FUNC; + ASSERT(db != NULL, return(0)); + + return(_alpm_gpgme_checksig(_alpm_db_path(db), + _alpm_db_pgpsig(db))); +} + + /* vim: set ts=2 sw=2 noet: */ diff --git a/lib/libalpm/signing.h b/lib/libalpm/signing.h index c004697..8fbb25d 100644 --- a/lib/libalpm/signing.h +++ b/lib/libalpm/signing.h @@ -21,7 +21,17 @@ #include "alpm.h" -int _alpm_gpgme_checksig(const char *pkgpath, const pmpgpsig_t *sig); +struct __pmpgpsig_t { + /* we will either store the encoded data or the raw data- + * this way we can decode on an as-needed basis since most + * operations won't require the overhead of base64 decodes + * on all packages in a sync repository. */ + char *encdata; + size_t rawlen; + unsigned char *rawdata; +}; + +int _alpm_gpgme_checksig(const char *path, const pmpgpsig_t *sig); #endif /* _ALPM_SIGNING_H */ -- 1.7.3.2

1 0

[pacman-dev] Appendix to signature patchset
by Denis A. Altoé Falqueto 20 Nov '10

20 Nov '10

Guys, This is a last patch for that series. It is a new patch, as Allan asked, so you can apply it in an already patched branch. The description on the patch itself is self explanatory. This is just to justify the new patch without poluting its description. Any sugestions or criticisms are always welcome. -- Denis Falqueto

2 9

[pacman-dev] Warn about using -Sy
by Evangelos Foutras 18 Nov '10

18 Nov '10

Oftentimes, I come across people using `pacman -Sy <name>' to install new packages. This installs the latest version of a package, while leaving any required libraries at their old version. The introduction of an incompatibility between a package and its dependencies is highly possible. A recent example of this issue is [1]. Could you please review the attached tiny patch for code structure, language used, and overall approach? -- [1] http://mailman.archlinux.org/pipermail/arch-general/2010-November/017198.ht…

7 12

[pacman-dev] Disk space checking branch "complete"
by Allan McRae 17 Nov '10

17 Nov '10

Hi, I have "finished" the disk space checking implementation. The only TODO left is to add the statvfs version of getmntinfo code path (NetBSD), but otherwise I consider this done. The calculations done are quite good but it is near impossible to be exact (e.g. adding/removing a block for directories but only once across the transaction, .pacsave/.pacnew files, filelist db files). I suppose I could add a block for those and not remove blocks to get an upper limit. However, the difference will likely be orders of magnitude smaller than the transaction size so I am not sure it is worth further effort... As far as the interface goes, the check is performed only when the CheckSpace option is given in pacman.conf. We also get a nice progress bar in pacman while the check is being performed (think of what is displayed during file conflict checking). See the work here: http://projects.archlinux.org/users/allan/pacman.git/diff/?h=diskspace&id2=… I need to rebase that branch into useful commit(s), but the overall changes are rather small (12 files changed, 447 insertions, 2 deletions - with 365 of those additions being in two new files). So I think code review can happen now. I am looking for comments on code correctness and very specific implementation details only. Anything other than that needs to be submitted in patch form... Allan

6 16