moparisthebest/pacman
1
0
Fork 0
mirror of https://github.com/moparisthebest/pacman synced 2024-12-22 15:58:50 -05:00
Code Issues Releases Wiki Activity

signing: check validity of all available signatures

Browse Source 
Change the check into a loop over all signatures present and returned by
GPGME. Also modify the return values and checks slightly now that I know
a little bit more about what type of values are returned.

Signed-off-by: Dan McGee <dan@archlinux.org>
This commit is contained in:
Dan McGee 2011-04-29 18:25:44 -05:00
parent 23a2d2c16a
commit cf1401a04d
1 changed files with 29 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
lib/libalpm/signing.c
View File

@ -292,7 +292,7 @@ int _alpm_gpgme_checksig(alpm_handle_t *handle, const char *path,
goto error; goto error;
} }
{ while(gpgsig) {
alpm_list_t *summary_list, *summary; alpm_list_t *summary_list, *summary;
_alpm_log(handle, PM_LOG_DEBUG, "fingerprint: %s\n", gpgsig->fpr); _alpm_log(handle, PM_LOG_DEBUG, "fingerprint: %s\n", gpgsig->fpr);
@ -304,35 +304,36 @@ int _alpm_gpgme_checksig(alpm_handle_t *handle, const char *path,
_alpm_log(handle, PM_LOG_DEBUG, "status: %s\n", gpgme_strerror(gpgsig->status)); _alpm_log(handle, PM_LOG_DEBUG, "status: %s\n", gpgme_strerror(gpgsig->status));
_alpm_log(handle, PM_LOG_DEBUG, "timestamp: %lu\n", gpgsig->timestamp); _alpm_log(handle, PM_LOG_DEBUG, "timestamp: %lu\n", gpgsig->timestamp);
_alpm_log(handle, PM_LOG_DEBUG, "exp_timestamp: %lu\n", gpgsig->exp_timestamp); _alpm_log(handle, PM_LOG_DEBUG, "exp_timestamp: %lu\n", gpgsig->exp_timestamp);
_alpm_log(handle, PM_LOG_DEBUG, "validity: %s\n", _alpm_log(handle, PM_LOG_DEBUG, "validity: %s; reason: %s\n",
string_validity(gpgsig->validity)); string_validity(gpgsig->validity),
_alpm_log(handle, PM_LOG_DEBUG, "validity_reason: %s\n",
gpgme_strerror(gpgsig->validity_reason)); gpgme_strerror(gpgsig->validity_reason));
_alpm_log(handle, PM_LOG_DEBUG, "pubkey algo: %s\n",
gpgme_pubkey_algo_name(gpgsig->pubkey_algo));
_alpm_log(handle, PM_LOG_DEBUG, "hash algo: %s\n",
gpgme_hash_algo_name(gpgsig->hash_algo));
}
if(gpgsig->summary & GPGME_SIGSUM_VALID) { /* Note: this is structured so any bad signature will set the return code
/* good signature, continue */ * to a bad one, but good ones just leave the default value in place; e.g.
_alpm_log(handle, PM_LOG_DEBUG, _("File %s has a valid signature.\n"), * worst case wins out. */
path); if(gpgsig->summary & GPGME_SIGSUM_VALID) {
} else if(gpgsig->summary & GPGME_SIGSUM_GREEN) { /* definite good signature */
/* 'green' signature, not sure what to do here */ _alpm_log(handle, PM_LOG_DEBUG, "result: valid signature\n");
_alpm_log(handle, PM_LOG_WARNING, _("File %s has a green signature.\n"), } else if(gpgsig->summary & GPGME_SIGSUM_GREEN) {
path); /* good signature */
} else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) { _alpm_log(handle, PM_LOG_DEBUG, "result: green signature\n");
handle->pm_errno = PM_ERR_SIG_UNKNOWN; } else if(gpgsig->summary & GPGME_SIGSUM_RED) {
_alpm_log(handle, PM_LOG_WARNING, _("File %s has a signature from an unknown key.\n"), /* definite bad signature, error */
path); _alpm_log(handle, PM_LOG_DEBUG, "result: red signature\n");
ret = -1; handle->pm_errno = PM_ERR_SIG_INVALID;
} else { ret = 1;
/* we'll capture everything else here */ } else if(gpgsig->summary & GPGME_SIGSUM_KEY_MISSING) {
handle->pm_errno = PM_ERR_SIG_INVALID; _alpm_log(handle, PM_LOG_DEBUG, "result: signature from unknown key\n");
_alpm_log(handle, PM_LOG_ERROR, _("File %s has an invalid signature.\n"), handle->pm_errno = PM_ERR_SIG_UNKNOWN;
path); ret = 1;
ret = 1; } else {
/* we'll capture everything else here */
_alpm_log(handle, PM_LOG_DEBUG, "result: invalid signature\n");
handle->pm_errno = PM_ERR_SIG_INVALID;
ret = 1;
}
gpgsig = gpgsig->next;
} }
error: error: