bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

makepkg: Emit early error if signature verification fails

Browse source 
Emit an early error message if tag or commit verification with git or
detached signature verification with gpg fails.
Make `verify_file_signature()` and `verify_git_signature()` return
non-zero in this case and set errors to `1`, so that later checks
in `check_pgpsigs()`, although still run, can not lead to a positive
result.

Signed-off-by: David Runge <dvzrv@archlinux.org>
This commit is contained in:
David Runge 2024-01-22 13:48:15 +01:00
parent bf76b5e89f
commit 3aa096a74f
No known key found for this signature in database
GPG key ID: 9B7A287D9A2EC608
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
scripts/libmakepkg/integrity/verify_signature.sh.in
View file

@ -157,7 +157,13 @@ verify_file_signature() {
"") decompress="cat" ;; "") decompress="cat" ;;
esac esac
$decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile" --verify "$file" - 2> /dev/null # verify the signature and write metadata to a status file
if ! $decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile" --verify "$file" - 2> /dev/null; then
printf '%s\n' "$(gettext "%s is unable to verify the signature.")" "gpg" >&2
errors=1
return 1
fi
return 0 return 0
} }
@ -189,7 +195,13 @@ verify_git_signature() {
printf " %s git repo ... " "${dir##*/}" >&2 printf " %s git repo ... " "${dir##*/}" >&2
git -C "$dir" verify-$fragtype --raw "$fragval" > "$statusfile" 2>&1 # verify the signature and write metadata to a status file
if ! git -C "$dir" verify-$fragtype --raw "$fragval" > "$statusfile" 2>&1; then
printf '%s\n' "$(gettext "%s is unable to verify the signature.")" "git" >&2
errors=1
return 1
fi
if ! grep -qs NEWSIG "$statusfile"; then if ! grep -qs NEWSIG "$statusfile"; then
printf '%s\n' "$(gettext "SIGNATURE NOT FOUND")" >&2 printf '%s\n' "$(gettext "SIGNATURE NOT FOUND")" >&2
errors=1 errors=1