]> git.saurik.com Git - apt-legacy.git/blame - methods/gpgv.cc
Fixed URLs with +'s not downloading from CDN.
[apt-legacy.git] / methods / gpgv.cc
CommitLineData
854e5ff1
JF
1extern "C" {
2 #include <mach-o/nlist.h>
3}
4
da6ee469
JF
5#include <apt-pkg/error.h>
6#include <apt-pkg/acquire-method.h>
7#include <apt-pkg/strutl.h>
8#include <apti18n.h>
9
10#include <sys/stat.h>
11#include <unistd.h>
12#include <utime.h>
13#include <stdio.h>
14#include <fcntl.h>
15#include <errno.h>
16#include <sys/wait.h>
17#include <iostream>
18#include <sstream>
19
20#define GNUPGPREFIX "[GNUPG:]"
21#define GNUPGBADSIG "[GNUPG:] BADSIG"
22#define GNUPGNOPUBKEY "[GNUPG:] NO_PUBKEY"
23#define GNUPGVALIDSIG "[GNUPG:] VALIDSIG"
24#define GNUPGNODATA "[GNUPG:] NODATA"
25
26class GPGVMethod : public pkgAcqMethod
27{
28 private:
29 string VerifyGetSigners(const char *file, const char *outfile,
30 vector<string> &GoodSigners, vector<string> &BadSigners,
31 vector<string> &NoPubKeySigners);
32
33 protected:
34 virtual bool Fetch(FetchItem *Itm);
35
36 public:
37
38 GPGVMethod() : pkgAcqMethod("1.0",SingleInstance | SendConfig) {};
39};
40
41string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
42 vector<string> &GoodSigners,
43 vector<string> &BadSigners,
44 vector<string> &NoPubKeySigners)
45{
46 // setup a (empty) stringstream for formating the return value
47 std::stringstream ret;
48 ret.str("");
49
50 if (_config->FindB("Debug::Acquire::gpgv", false))
51 {
52 std::cerr << "inside VerifyGetSigners" << std::endl;
53 }
54 pid_t pid;
55 int fd[2];
56 FILE *pipein;
57 int status;
58 struct stat buff;
59 string gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
60 string pubringpath = _config->Find("APT::GPGV::TrustedKeyring", "/etc/apt/trusted.gpg");
61 if (_config->FindB("Debug::Acquire::gpgv", false))
62 {
63 std::cerr << "gpgv path: " << gpgvpath << std::endl;
64 std::cerr << "Keyring path: " << pubringpath << std::endl;
65 }
66
67 if (stat(pubringpath.c_str(), &buff) != 0)
68 {
69 ioprintf(ret, _("Couldn't access keyring: '%s'"), strerror(errno));
70 return ret.str();
71 }
72 if (pipe(fd) < 0)
73 {
74 return "Couldn't create pipe";
75 }
76
77 pid = fork();
78 if (pid < 0)
79 {
80 return string("Couldn't spawn new process") + strerror(errno);
81 }
82 else if (pid == 0)
83 {
84 const char *Args[400];
85 unsigned int i = 0;
86
87 Args[i++] = gpgvpath.c_str();
88 Args[i++] = "--status-fd";
89 Args[i++] = "3";
90 Args[i++] = "--keyring";
91 Args[i++] = pubringpath.c_str();
92
93 Configuration::Item const *Opts;
94 Opts = _config->Tree("Acquire::gpgv::Options");
95 if (Opts != 0)
96 {
97 Opts = Opts->Child;
98 for (; Opts != 0; Opts = Opts->Next)
99 {
100 if (Opts->Value.empty() == true)
101 continue;
102 Args[i++] = Opts->Value.c_str();
103 if(i >= 395) {
104 std::cerr << _("E: Argument list from Acquire::gpgv::Options too long. Exiting.") << std::endl;
105 exit(111);
106 }
107 }
108 }
109 Args[i++] = file;
110 Args[i++] = outfile;
111 Args[i++] = NULL;
112
113 if (_config->FindB("Debug::Acquire::gpgv", false))
114 {
115 std::cerr << "Preparing to exec: " << gpgvpath;
116 for(unsigned int j=0;Args[j] != NULL; j++)
117 std::cerr << " " << Args[j];
118 std::cerr << std::endl;
119 }
120 int nullfd = open("/dev/null", O_RDONLY);
121 close(fd[0]);
122 // Redirect output to /dev/null; we read from the status fd
123 dup2(nullfd, STDOUT_FILENO);
124 dup2(nullfd, STDERR_FILENO);
125 // Redirect the pipe to the status fd (3)
126 dup2(fd[1], 3);
127
128 putenv("LANG=");
129 putenv("LC_ALL=");
130 putenv("LC_MESSAGES=");
131 execvp(gpgvpath.c_str(), (char **)Args);
132
133 exit(111);
134 }
135 close(fd[1]);
136
137 pipein = fdopen(fd[0], "r");
138
139 // Loop over the output of gpgv, and check the signatures.
140 size_t buffersize = 64;
141 char *buffer = (char *) malloc(buffersize);
142 size_t bufferoff = 0;
143 while (1)
144 {
145 int c;
146
147 // Read a line. Sigh.
148 while ((c = getc(pipein)) != EOF && c != '\n')
149 {
150 if (bufferoff == buffersize)
151 buffer = (char *) realloc(buffer, buffersize *= 2);
152 *(buffer+bufferoff) = c;
153 bufferoff++;
154 }
155 if (bufferoff == 0 && c == EOF)
156 break;
157 *(buffer+bufferoff) = '\0';
158 bufferoff = 0;
159 if (_config->FindB("Debug::Acquire::gpgv", false))
160 std::cerr << "Read: " << buffer << std::endl;
161
162 // Push the data into three separate vectors, which
163 // we later concatenate. They're kept separate so
164 // if we improve the apt method communication stuff later
165 // it will be better.
166 if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0)
167 {
168 if (_config->FindB("Debug::Acquire::gpgv", false))
169 std::cerr << "Got BADSIG! " << std::endl;
170 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
171 }
172
173 if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
174 {
175 if (_config->FindB("Debug::Acquire::gpgv", false))
176 std::cerr << "Got NO_PUBKEY " << std::endl;
177 NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
178 }
179 if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
180 {
181 if (_config->FindB("Debug::Acquire::gpgv", false))
182 std::cerr << "Got NODATA! " << std::endl;
183 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
184 }
185 if (strncmp(buffer, GNUPGVALIDSIG, sizeof(GNUPGVALIDSIG)-1) == 0)
186 {
187 char *sig = buffer + sizeof(GNUPGPREFIX);
188 char *p = sig + sizeof("VALIDSIG");
189 while (*p && isxdigit(*p))
190 p++;
191 *p = 0;
192 if (_config->FindB("Debug::Acquire::gpgv", false))
193 std::cerr << "Got VALIDSIG, key ID:" << sig << std::endl;
194 GoodSigners.push_back(string(sig));
195 }
196 }
197 fclose(pipein);
198
199 waitpid(pid, &status, 0);
200 if (_config->FindB("Debug::Acquire::gpgv", false))
201 {
202 std::cerr << "gpgv exited\n";
203 }
204
205 if (WEXITSTATUS(status) == 0)
206 {
207 if (GoodSigners.empty())
208 return _("Internal error: Good signature, but could not determine key fingerprint?!");
209 return "";
210 }
211 else if (WEXITSTATUS(status) == 1)
212 {
213 return _("At least one invalid signature was encountered.");
214 }
215 else if (WEXITSTATUS(status) == 111)
216 {
217 ioprintf(ret, _("Could not execute '%s' to verify signature (is gnupg installed?)"), gpgvpath.c_str());
218 return ret.str();
219 }
220 else
221 {
222 return _("Unknown error executing gpgv");
223 }
224}
225
226bool GPGVMethod::Fetch(FetchItem *Itm)
227{
228 URI Get = Itm->Uri;
229 string Path = Get.Host + Get.Path; // To account for relative paths
230 string keyID;
231 vector<string> GoodSigners;
232 vector<string> BadSigners;
233 vector<string> NoPubKeySigners;
234
235 FetchResult Res;
236 Res.Filename = Itm->DestFile;
237 URIStart(Res);
238
239 // Run gpgv on file, extract contents and get the key ID of the signer
240 string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(),
241 GoodSigners, BadSigners, NoPubKeySigners);
242 if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty())
243 {
244 string errmsg;
245 // In this case, something bad probably happened, so we just go
246 // with what the other method gave us for an error message.
247 if (BadSigners.empty() && NoPubKeySigners.empty())
248 errmsg = msg;
249 else
250 {
251 if (!BadSigners.empty())
252 {
253 errmsg += _("The following signatures were invalid:\n");
254 for (vector<string>::iterator I = BadSigners.begin();
255 I != BadSigners.end(); I++)
256 errmsg += (*I + "\n");
257 }
258 if (!NoPubKeySigners.empty())
259 {
260 errmsg += _("The following signatures couldn't be verified because the public key is not available:\n");
261 for (vector<string>::iterator I = NoPubKeySigners.begin();
262 I != NoPubKeySigners.end(); I++)
263 errmsg += (*I + "\n");
264 }
265 }
266 // this is only fatal if we have no good sigs or if we have at
267 // least one bad signature. good signatures and NoPubKey signatures
268 // happen easily when a file is signed with multiple signatures
269 if(GoodSigners.empty() or !BadSigners.empty())
270 return _error->Error(errmsg.c_str());
271 }
272
273 // Transfer the modification times
274 struct stat Buf;
275 if (stat(Path.c_str(),&Buf) != 0)
276 return _error->Errno("stat",_("Failed to stat %s"), Path.c_str());
277
278 struct utimbuf TimeBuf;
279 TimeBuf.actime = Buf.st_atime;
280 TimeBuf.modtime = Buf.st_mtime;
281 if (utime(Itm->DestFile.c_str(),&TimeBuf) != 0)
282 return _error->Errno("utime",_("Failed to set modification time"));
283
284 if (stat(Itm->DestFile.c_str(),&Buf) != 0)
285 return _error->Errno("stat",_("Failed to stat"));
286
287 // Return a Done response
288 Res.LastModified = Buf.st_mtime;
289 Res.Size = Buf.st_size;
290 // Just pass the raw output up, because passing it as a real data
291 // structure is too difficult with the method stuff. We keep it
292 // as three separate vectors for future extensibility.
293 Res.GPGVOutput = GoodSigners;
294 Res.GPGVOutput.insert(Res.GPGVOutput.end(),BadSigners.begin(),BadSigners.end());
295 Res.GPGVOutput.insert(Res.GPGVOutput.end(),NoPubKeySigners.begin(),NoPubKeySigners.end());
296 URIDone(Res);
297
298 if (_config->FindB("Debug::Acquire::gpgv", false))
299 {
300 std::cerr << "gpgv succeeded\n";
301 }
302
303 return true;
304}
305
306
4c8eb365 307int main()
da6ee469 308{
fe23a696 309#if !defined(__ENVIRONMENT_ASPEN_VERSION_MIN_REQUIRED__) || __ENVIRONMENT_ASPEN_VERSION_MIN_REQUIRED__ < 10200
854e5ff1
JF
310 struct nlist nl[2];
311 memset(nl, 0, sizeof(nl));
3d6f1076 312 nl[0].n_un.n_name = (char *) "_useMDNSResponder";
854e5ff1
JF
313 nlist("/usr/lib/libc.dylib", nl);
314 if (nl[0].n_type != N_UNDF)
315 *(int *) nl[0].n_value = 0;
fe23a696 316#endif
854e5ff1 317
da6ee469
JF
318 setlocale(LC_ALL, "");
319
320 GPGVMethod Mth;
321
322 return Mth.Run();
323}