bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

repo-add: enforce maximum .sig file size

Browse source 
This prevents user error in adding a file generated via `gpg --sign`
rather than `--detach-sign`, for example. The same 16KiB limit is used
we use in our pacman download code.

The section is moved above the checksum generation to avoid presenting
info messages to the user if the signature isn't valid.

Addresses a shortcoming pointed out in FS#27453.

Signed-off-by: Dan McGee <dan@archlinux.org>
This commit is contained in:
Dan McGee 2011-12-05 10:07:40 -06:00
parent d85d0ddcfe
commit 17e0be9e6a
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
scripts/repo-add.sh.in
View file

@ -245,7 +245,7 @@ db_write_entry() {
local pkgfile="$1"
local -a _groups _licenses _replaces _depends _conflicts _provides _optdepends
local pkgname pkgver pkgdesc csize size url arch builddate packager \
md5sum sha256sum pgpsig
md5sum sha256sum pgpsig pgpsigsize
# read info from the zipped package
local line var val
@ -284,6 +284,17 @@ db_write_entry() {
fi
fi
# compute base64'd PGP signature
if [[ -f "$pkgfile.sig" ]]; then
pgpsigsize=$(@SIZECMD@ "$pkgfile.sig")
if (( pgpsigsize > 16384 )); then
error "$(gettext "Invalid package signature file '%s'.")" "$pkgfile.sig"
return 1
fi
msg2 "$(gettext "Adding package signature...")"
pgpsig=$(openssl base64 -in "$pkgfile.sig" | tr -d '\n')
fi
csize=$(@SIZECMD@ "$pkgfile")
# compute checksums
@ -293,12 +304,6 @@ db_write_entry() {
sha256sum="$(openssl dgst -sha256 "$pkgfile")"
sha256sum="${sha256sum##* }"
# compute base64'd PGP signature
if [[ -f "$pkgfile.sig" ]]; then
msg2 "$(gettext "Adding package signature...")"
pgpsig=$(openssl base64 -in "$pkgfile.sig" | tr -d '\n')
fi
# remove an existing entry if it exists, ignore failures
db_remove_entry "$pkgname"