moparisthebest/wget
1
0
Fork 0
mirror of https://github.com/moparisthebest/wget synced 2024-07-03 16:38:41 -04:00
Code Issues Releases Wiki Activity

Support at most one file signature. Adapt comments to libmetalink 0.13.

Browse Source 
* src/metalink.c (retrieve_from_metalink): Add comment about new
libmetalink version. Do not iterate over signatures - support just one.
This commit is contained in:
Hubert Tarasiuk 2015-07-02 00:16:12 +02:00 committed by Giuseppe Scrivano
parent 225a87d4a2
commit 97389a7497
1 changed files with 107 additions and 106 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
src/metalink.c
View File

@ -224,15 +224,21 @@ retrieve_from_metalink (const metalink_t* metalink)
sig_status = 0; /* Not verified. */
#ifdef HAVE_GPGME
/* Check the crypto signature. */
/* Check the crypto signature.
Note that the signtures from Metalink in XML will not be
parsed when using libmetalink version older than 0.1.3.
Metalink-over-HTTP is not affected by this problem. */
if (mfile->signature)
{
metalink_signature_t *msig;
metalink_signature_t *msig = mfile->signature;
gpgme_error_t gpgerr;
gpgme_ctx_t gpgctx;
gpgme_data_t gpgsigdata, gpgdata;
gpgme_verify_result_t gpgres;
int fd;
gpgme_signature_t gpgsig;
gpgme_protocol_t gpgprot = GPGME_PROTOCOL_UNKNOWN;
int fd = -1;
/* Initialize the library - as name suggests. */
gpgme_check_version (NULL);
@ -254,7 +260,7 @@ retrieve_from_metalink (const metalink_t* metalink)
logprintf (LOG_NOTQUIET,
"GPGME data_new_from_fd: %s\n",
gpgme_strerror (gpgerr));
goto gpg_cleanup_fd;
goto gpg_skip_verification;
}
/* Prepare new GPGME context. */
@ -264,20 +270,10 @@ retrieve_from_metalink (const metalink_t* metalink)
logprintf (LOG_NOTQUIET,
"GPGME new: %s\n",
gpgme_strerror (gpgerr));
goto gpg_cleanup_data;
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
/* Note that this will only work for Metalink-over-HTTP
requests (that we parse manually) due to a bug in
Libmetalink. Another problem with Libmetalink is that
it supports at most one signature per file. The below
line should be modified after Libmetalink resolves these
issues. */
for (msig = mfile->signature; msig == mfile->signature; msig++)
{
gpgme_signature_t gpgsig;
gpgme_protocol_t gpgprot = GPGME_PROTOCOL_UNKNOWN;
DEBUGP (("Veryfying signature %s:\n%s\n",
quote (msig->mediatype),
msig->signature));
@ -286,7 +282,11 @@ retrieve_from_metalink (const metalink_t* metalink)
if (!strcmp (msig->mediatype, "application/pgp-signature"))
gpgprot = GPGME_PROTOCOL_OpenPGP;
else /* Unsupported signature type. */
continue;
{
gpgme_release (gpgctx);
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
gpgerr = gpgme_set_protocol (gpgctx, gpgprot);
if (gpgerr != GPG_ERR_NO_ERROR)
@ -294,7 +294,9 @@ retrieve_from_metalink (const metalink_t* metalink)
logprintf (LOG_NOTQUIET,
"GPGME set_protocol: %s\n",
gpgme_strerror (gpgerr));
continue;
gpgme_release (gpgctx);
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
/* Load the signature. */
@ -307,7 +309,9 @@ retrieve_from_metalink (const metalink_t* metalink)
logprintf (LOG_NOTQUIET,
_("GPGME data_new_from_mem: %s\n"),
gpgme_strerror (gpgerr));
continue;
gpgme_release (gpgctx);
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
/* Verify the signature. */
@ -318,7 +322,9 @@ retrieve_from_metalink (const metalink_t* metalink)
_("GPGME op_verify: %s\n"),
gpgme_strerror (gpgerr));
gpgme_data_release (gpgsigdata);
continue;
gpgme_release (gpgctx);
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
/* Check the results. */
@ -328,7 +334,9 @@ retrieve_from_metalink (const metalink_t* metalink)
logputs (LOG_NOTQUIET,
_("GPGME op_verify_result: NULL\n"));
gpgme_data_release (gpgsigdata);
continue;
gpgme_release (gpgctx);
gpgme_data_release (gpgdata);
goto gpg_skip_verification;
}
/* The list is null-terminated. */
@ -371,20 +379,13 @@ retrieve_from_metalink (const metalink_t* metalink)
gpgme_strerror (gpgsig->status & 0xFFFF));
}
}
gpgme_data_release (gpgsigdata);
if (sig_status != 0)
break;
} /* Iterate over signatures. */
gpgme_release (gpgctx);
gpg_cleanup_data:
gpgme_data_release (gpgdata);
gpg_cleanup_fd:
gpg_skip_verification:
if (fd != -1)
close (fd);
} /* endif (mfile->signature) */
gpg_skip_verification:
#endif
/* Stop if file was downloaded with success. */
if (sig_status >= 0)