bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

verify_signature: wait as long as possible before bailing

Browse source 
Bailing early caused problems with makepkg failing on verify but expired
signatures.  As this is often out of the packagers control, and it is
better to verify a signature than not, we try bailing as late as possible
and let makepkg warn about the expired signature.

Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Allan McRae 2024-02-18 21:45:51 +10:00
parent 7016adcb70
commit c7c4c2a7d2
1 changed files with 4 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
scripts/libmakepkg/integrity/verify_signature.sh.in
View file

@ -164,19 +164,9 @@ verify_file_signature() {
"") decompress="cat" ;; "") decompress="cat" ;;
esac esac
# verify the signature and write metadata to a status file
if ! $decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile_raw" --verify "$file" - 2> /dev/null; then
printf '%s %s\n' "gpg" "$(gettext "is unable to verify the signature.")" >&2
errors=1
return 1
fi
# create a statusfile that contains only understood terms # create a statusfile that contains only understood terms
if ! filter_gnupg_statusfile > "$statusfile" < "$statusfile_raw"; then $decompress < "$sourcefile" | gpg --quiet --batch --status-file "$statusfile_raw" --verify "$file" - 2> /dev/null
printf '%s\n' "$(gettext "unable to extract signature metadata.")" >&2 filter_gnupg_statusfile > "$statusfile" < "$statusfile_raw"
errors=1
return 1
fi
return 0 return 0
} }
@ -209,19 +199,9 @@ verify_git_signature() {
printf " %s git repo ... " "${dir##*/}" >&2 printf " %s git repo ... " "${dir##*/}" >&2
# verify the signature and write metadata to a status file
if ! git -C "$dir" verify-$fragtype --raw "$fragval" > "$statusfile_raw" 2>&1; then
printf '%s %s\n' "git" "$(gettext "is unable to verify the signature.")" >&2
errors=1
return 1
fi
# create a statusfile that contains only understood terms # create a statusfile that contains only understood terms
if ! filter_gnupg_statusfile > "$statusfile" < "$statusfile_raw"; then git -C "$dir" verify-$fragtype --raw "$fragval" > "$statusfile_raw" 2>&1
printf '%s\n' "$(gettext "unable to extract signature metadata.")" >&2 filter_gnupg_statusfile > "$statusfile" < "$statusfile_raw"
errors=1
return 1
fi
return 0 return 0
} }