bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pacman-key: just accept one file to verify, and enforce detached sigs

Browse source 
Simply pass options on to gpg the same way gpg uses them -- no looping
through and checking lots of signatures.

This prevents a situation where the signature file to be verified is
manipulated to contain an embedded signature which is valid, but not a
detached signature for the file you are actually trying to verify.

gpg does not offer an option to verify many files at once by naming each
signature/file pair, and there's no reason for us to do so either, since
it would be quite tiresome to do so.

In the event that there is no signature/file pair specified to
pacman-key itself,

- preserve gpg's behavior, *if* the matching file does not exist, by
 - assuming the signature is an embedded signature
- deviate from gpg's behavior, by
 - offering a security warning about which one is happening
 - when there is an embedded signature *and* a matching detached file,
   assume the latter is desired

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Eli Schwartz 2018-10-21 13:28:41 -04:00 • committed by Allan McRae
parent d230ec6f17
commit 635a9c911c
2 changed files with 26 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
doc/pacman-key.8.asciidoc
View file

@ -97,7 +97,13 @@ Operations
Displays the program version. Displays the program version.
*-v, \--verify*:: *-v, \--verify*::
Verify the file(s) specified by the signature(s). Assume that the first argument is a signature and verify it. If a second
argument is provided, it is the file to be verified.
+
With only one argument given, assume that the signature is a detached
signature, and look for a matching data file to verify by stripping the file
extension. If no matching data file is found, fall back on GnuPG semantics and
attempt to verify a file with an embedded signature.
Options Options

31
scripts/pacman-key.sh.in
View file

@ -485,18 +485,25 @@ refresh_keys() {
} }
verify_sig() { verify_sig() {
local ret=0 local ret=0 sig=$1 file=$2
for sig; do if [[ -z $file && -f ${sig%.*} ]]; then
msg "Checking %s..." "$sig" file=${sig%.*}
if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then fi
error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig" if [[ -n $file ]]; then
return 1 local files=("$sig" "$file")
fi msg "Checking %s... (detached)" "$sig"
if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "$sig" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then else
error "$(gettext "The signature identified by %s could not be verified.")" "$sig" local files=("$sig")
ret=1 msg "Checking %s... (embedded)" "$sig"
fi fi
done if grep -q 'BEGIN PGP SIGNATURE' "$sig"; then
error "$(gettext "Cannot use armored signatures for packages: %s")" "$sig"
exit 1
fi
if ! "${GPG_PACMAN[@]}" --status-fd 1 --verify "${files[@]}" | grep -qE '^\[GNUPG:\] TRUST_(FULLY|ULTIMATE).*$'; then
error "$(gettext "The signature identified by %s could not be verified.")" "$sig"
ret=1
fi
exit $ret exit $ret
} }