]> git.saurik.com Git - apt.git/blame - methods/gpgv.cc
don't show NO_PUBKEY warning if repo is signed by another key
[apt.git] / methods / gpgv.cc
CommitLineData
ea542140
DK
1#include <config.h>
2
b3d44315 3#include <apt-pkg/acquire-method.h>
472ff00e 4#include <apt-pkg/configuration.h>
453b82a3 5#include <apt-pkg/error.h>
2f5b6151 6#include <apt-pkg/gpgv.h>
453b82a3 7#include <apt-pkg/strutl.h>
3927c6da 8#include <apt-pkg/fileutl.h>
23e64f6d 9#include "aptmethod.h"
b3d44315 10
453b82a3 11#include <ctype.h>
b3d44315 12#include <errno.h>
453b82a3
DK
13#include <stddef.h>
14#include <stdio.h>
15#include <stdlib.h>
16#include <string.h>
b3d44315 17#include <sys/wait.h>
453b82a3 18#include <unistd.h>
4e03c47d 19
d9105124 20#include <array>
4e03c47d 21#include <algorithm>
d9105124
JAK
22#include <sstream>
23#include <iterator>
b3d44315 24#include <iostream>
453b82a3 25#include <string>
f5a3d009
DK
26#include <vector>
27
ea542140
DK
28#include <apti18n.h>
29
8f3ba4e8
DK
30using std::string;
31using std::vector;
32
b3d44315
MV
33#define GNUPGPREFIX "[GNUPG:]"
34#define GNUPGBADSIG "[GNUPG:] BADSIG"
08b7761a 35#define GNUPGERRSIG "[GNUPG:] ERRSIG"
b3d44315
MV
36#define GNUPGNOPUBKEY "[GNUPG:] NO_PUBKEY"
37#define GNUPGVALIDSIG "[GNUPG:] VALIDSIG"
c5d8878d 38#define GNUPGGOODSIG "[GNUPG:] GOODSIG"
f13b413a 39#define GNUPGEXPKEYSIG "[GNUPG:] EXPKEYSIG"
1af227c2 40#define GNUPGEXPSIG "[GNUPG:] EXPSIG"
c5d8878d 41#define GNUPGREVKEYSIG "[GNUPG:] REVKEYSIG"
2abb68b7 42#define GNUPGNODATA "[GNUPG:] NODATA"
b3d44315 43
349c5c89
JAK
44struct Digest {
45 enum class State {
46 Untrusted,
47 Weak,
48 Trusted,
49 } state;
50 char name[32];
08b7761a
DK
51
52 State getState() const {
6a4958d3
JAK
53 std::string optionUntrusted;
54 std::string optionWeak;
55 strprintf(optionUntrusted, "APT::Hashes::%s::Untrusted", name);
56 strprintf(optionWeak, "APT::Hashes::%s::Weak", name);
57 if (_config->FindB(optionUntrusted, state == State::Untrusted) == true)
08b7761a 58 return State::Untrusted;
6a4958d3
JAK
59 if (_config->FindB(optionWeak, state == State::Weak) == true)
60 return State::Weak;
61
62 return state;
08b7761a 63 }
d9105124
JAK
64};
65
349c5c89
JAK
66static constexpr Digest Digests[] = {
67 {Digest::State::Untrusted, "Invalid digest"},
68 {Digest::State::Untrusted, "MD5"},
69 {Digest::State::Weak, "SHA1"},
70 {Digest::State::Weak, "RIPE-MD/160"},
71 {Digest::State::Trusted, "Reserved digest"},
72 {Digest::State::Trusted, "Reserved digest"},
73 {Digest::State::Trusted, "Reserved digest"},
74 {Digest::State::Trusted, "Reserved digest"},
75 {Digest::State::Trusted, "SHA256"},
76 {Digest::State::Trusted, "SHA384"},
77 {Digest::State::Trusted, "SHA512"},
6a4958d3 78 {Digest::State::Trusted, "SHA224"},
349c5c89
JAK
79};
80
81static Digest FindDigest(std::string const & Digest)
82{
83 int id = atoi(Digest.c_str());
84 if (id >= 0 && static_cast<unsigned>(id) < _count(Digests)) {
85 return Digests[id];
86 } else {
87 return Digests[0];
88 }
89}
90
91struct Signer {
92 std::string key;
93 std::string note;
07ea3af0 94};
08b7761a
DK
95static bool IsTheSameKey(std::string const &validsig, std::string const &goodsig) {
96 // VALIDSIG reports a keyid (40 = 24 + 16), GOODSIG is a longid (16) only
97 return validsig.compare(24, 16, goodsig, strlen("GOODSIG "), 16) == 0;
98}
07ea3af0 99
23e64f6d 100class GPGVMethod : public aptMethod
b3d44315
MV
101{
102 private:
da9ed163 103 string VerifyGetSigners(const char *file, const char *outfile,
b0d40854
DK
104 std::string const &key,
105 vector<string> &GoodSigners,
c5d8878d
MV
106 vector<string> &BadSigners,
107 vector<string> &WorthlessSigners,
349c5c89 108 vector<Signer> &SoonWorthlessSigners,
b3d44315 109 vector<string> &NoPubKeySigners);
b3d44315 110 protected:
3b302846 111 virtual bool URIAcquire(std::string const &Message, FetchItem *Itm) APT_OVERRIDE;
b3d44315 112 public:
23e64f6d 113 GPGVMethod() : aptMethod("gpgv","1.0",SingleInstance | SendConfig) {};
b3d44315
MV
114};
115
da9ed163 116string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
b0d40854 117 std::string const &key,
b3d44315
MV
118 vector<string> &GoodSigners,
119 vector<string> &BadSigners,
c5d8878d 120 vector<string> &WorthlessSigners,
349c5c89 121 vector<Signer> &SoonWorthlessSigners,
b3d44315
MV
122 vector<string> &NoPubKeySigners)
123{
46e39c8e 124 bool const Debug = _config->FindB("Debug::Acquire::gpgv", false);
da9ed163 125
46e39c8e
MV
126 if (Debug == true)
127 std::clog << "inside VerifyGetSigners" << std::endl;
128
b3d44315 129 int fd[2];
4e03c47d 130 bool const keyIsID = (key.empty() == false && key[0] != '/');
46e39c8e 131
b3d44315 132 if (pipe(fd) < 0)
b3d44315 133 return "Couldn't create pipe";
b3d44315 134
cf440fac 135 pid_t pid = fork();
b3d44315 136 if (pid < 0)
da9ed163 137 return string("Couldn't spawn new process") + strerror(errno);
b3d44315 138 else if (pid == 0)
4e03c47d 139 ExecGPGV(outfile, file, 3, fd, (keyIsID ? "" : key));
b3d44315
MV
140 close(fd[1]);
141
cf440fac
DK
142 FILE *pipein = fdopen(fd[0], "r");
143
b39bb552 144 // Loop over the output of apt-key (which really is gnupg), and check the signatures.
4e03c47d 145 std::vector<std::string> ValidSigners;
08b7761a 146 std::vector<std::string> ErrSigners;
bf6ac7ca
DK
147 size_t buffersize = 0;
148 char *buffer = NULL;
b3d44315
MV
149 while (1)
150 {
bf6ac7ca
DK
151 if (getline(&buffer, &buffersize, pipein) == -1)
152 break;
46e39c8e
MV
153 if (Debug == true)
154 std::clog << "Read: " << buffer << std::endl;
b3d44315
MV
155
156 // Push the data into three separate vectors, which
157 // we later concatenate. They're kept separate so
158 // if we improve the apt method communication stuff later
159 // it will be better.
160 if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0)
161 {
46e39c8e
MV
162 if (Debug == true)
163 std::clog << "Got BADSIG! " << std::endl;
b3d44315
MV
164 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
165 }
08b7761a
DK
166 else if (strncmp(buffer, GNUPGERRSIG, sizeof(GNUPGERRSIG)-1) == 0)
167 {
168 if (Debug == true)
169 std::clog << "Got ERRSIG " << std::endl;
170 ErrSigners.push_back(string(buffer, strlen(GNUPGPREFIX), strlen("ERRSIG ") + 16));
171 }
4e03c47d 172 else if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
b3d44315 173 {
46e39c8e
MV
174 if (Debug == true)
175 std::clog << "Got NO_PUBKEY " << std::endl;
b3d44315 176 NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
08b7761a
DK
177 ErrSigners.erase(std::remove_if(ErrSigners.begin(), ErrSigners.end(), [&](std::string const &errsig) {
178 return errsig.compare(strlen("ERRSIG "), 16, buffer, strlen(GNUPGNOPUBKEY), 16) == 0; }), ErrSigners.end());
b3d44315 179 }
4e03c47d 180 else if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
2abb68b7 181 {
46e39c8e
MV
182 if (Debug == true)
183 std::clog << "Got NODATA! " << std::endl;
2abb68b7
MV
184 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
185 }
f13b413a 186 else if (strncmp(buffer, GNUPGEXPKEYSIG, sizeof(GNUPGEXPKEYSIG)-1) == 0)
c5d8878d 187 {
46e39c8e 188 if (Debug == true)
f13b413a 189 std::clog << "Got EXPKEYSIG! " << std::endl;
c5d8878d
MV
190 WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
191 }
1af227c2
DK
192 else if (strncmp(buffer, GNUPGEXPSIG, sizeof(GNUPGEXPSIG)-1) == 0)
193 {
194 if (Debug == true)
195 std::clog << "Got EXPSIG!" << std::endl;
196 WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
197 }
4e03c47d 198 else if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0)
c5d8878d 199 {
46e39c8e
MV
200 if (Debug == true)
201 std::clog << "Got REVKEYSIG! " << std::endl;
c5d8878d
MV
202 WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
203 }
4e03c47d 204 else if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0)
b3d44315 205 {
fb7b11eb
DK
206 char *sig = buffer + sizeof(GNUPGGOODSIG);
207 char *p = sig;
b3d44315
MV
208 while (*p && isxdigit(*p))
209 p++;
210 *p = 0;
46e39c8e 211 if (Debug == true)
fb7b11eb
DK
212 std::clog << "Got GOODSIG, key ID: " << sig << std::endl;
213 GoodSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
b3d44315 214 }
4e03c47d
DK
215 else if (strncmp(buffer, GNUPGVALIDSIG, sizeof(GNUPGVALIDSIG)-1) == 0)
216 {
217 char *sig = buffer + sizeof(GNUPGVALIDSIG);
d9105124
JAK
218 std::istringstream iss((string(sig)));
219 vector<string> tokens{std::istream_iterator<string>{iss},
220 std::istream_iterator<string>{}};
4e03c47d
DK
221 char *p = sig;
222 while (*p && isxdigit(*p))
223 p++;
224 *p = 0;
d9105124 225 // Reject weak digest algorithms
349c5c89 226 Digest digest = FindDigest(tokens[7]);
08b7761a 227 switch (digest.getState()) {
349c5c89 228 case Digest::State::Weak:
07ea3af0
JAK
229 // Treat them like an expired key: For that a message about expiry
230 // is emitted, a VALIDSIG, but no GOODSIG.
349c5c89 231 SoonWorthlessSigners.push_back({string(sig), digest.name});
8fa99570
DK
232 if (Debug == true)
233 std::clog << "Got weak VALIDSIG, key ID: " << sig << std::endl;
349c5c89
JAK
234 break;
235 case Digest::State::Untrusted:
08fd77e8
JAK
236 // Treat them like an expired key: For that a message about expiry
237 // is emitted, a VALIDSIG, but no GOODSIG.
349c5c89 238 WorthlessSigners.push_back(string(sig));
08b7761a
DK
239 GoodSigners.erase(std::remove_if(GoodSigners.begin(), GoodSigners.end(), [&](std::string const &goodsig) {
240 return IsTheSameKey(string(sig), goodsig); }), GoodSigners.end());
8fa99570
DK
241 if (Debug == true)
242 std::clog << "Got untrusted VALIDSIG, key ID: " << sig << std::endl;
349c5c89 243 break;
6a4958d3
JAK
244
245 case Digest::State::Trusted:
8fa99570
DK
246 if (Debug == true)
247 std::clog << "Got trusted VALIDSIG, key ID: " << sig << std::endl;
349c5c89 248 break;
08fd77e8 249 }
d9105124 250
4e03c47d
DK
251 ValidSigners.push_back(string(sig));
252 }
b3d44315
MV
253 }
254 fclose(pipein);
1b7bf822 255 free(buffer);
08b7761a 256 std::move(ErrSigners.begin(), ErrSigners.end(), std::back_inserter(WorthlessSigners));
b3d44315 257
4e03c47d
DK
258 // apt-key has a --keyid parameter, but this requires gpg, so we call it without it
259 // and instead check after the fact which keyids where used for verification
260 if (keyIsID == true)
261 {
262 if (Debug == true)
263 std::clog << "GoodSigs needs to be limited to keyid " << key << std::endl;
264 std::vector<std::string>::iterator const foundItr = std::find(ValidSigners.begin(), ValidSigners.end(), key);
265 bool const found = (foundItr != ValidSigners.end());
266 std::copy(GoodSigners.begin(), GoodSigners.end(), std::back_insert_iterator<std::vector<std::string> >(NoPubKeySigners));
267 if (found)
268 {
269 // we look for GOODSIG here as well as an expired sig is a valid sig as well (but not a good one)
270 std::string const goodlongkeyid = "GOODSIG " + key.substr(24, 16);
271 bool const foundGood = std::find(GoodSigners.begin(), GoodSigners.end(), goodlongkeyid) != GoodSigners.end();
272 if (Debug == true)
273 std::clog << "Key " << key << " is valid sig, is " << goodlongkeyid << " also a good one? " << (foundGood ? "yes" : "no") << std::endl;
274 GoodSigners.clear();
275 if (foundGood)
276 {
277 GoodSigners.push_back(goodlongkeyid);
278 NoPubKeySigners.erase(std::remove(NoPubKeySigners.begin(), NoPubKeySigners.end(), goodlongkeyid), NoPubKeySigners.end());
279 }
280 }
281 else
282 GoodSigners.clear();
283 }
284
cf440fac 285 int status;
b3d44315 286 waitpid(pid, &status, 0);
46e39c8e 287 if (Debug == true)
b3d44315 288 {
2737f28a 289 ioprintf(std::clog, "gpgv exited with status %i\n", WEXITSTATUS(status));
b3d44315 290 }
08b7761a
DK
291
292 if (Debug)
293 {
294 std::cerr << "Summary:" << std::endl << " Good: ";
295 std::copy(GoodSigners.begin(), GoodSigners.end(), std::ostream_iterator<std::string>(std::cerr, ", "));
296 std::cerr << std::endl << " Bad: ";
297 std::copy(BadSigners.begin(), BadSigners.end(), std::ostream_iterator<std::string>(std::cerr, ", "));
298 std::cerr << std::endl << " Worthless: ";
299 std::copy(WorthlessSigners.begin(), WorthlessSigners.end(), std::ostream_iterator<std::string>(std::cerr, ", "));
300 std::cerr << std::endl << " SoonWorthless: ";
301 std::for_each(SoonWorthlessSigners.begin(), SoonWorthlessSigners.end(), [](Signer const &sig) { std::cerr << sig.key << ", "; });
302 std::cerr << std::endl << " NoPubKey: ";
303 std::copy(NoPubKeySigners.begin(), NoPubKeySigners.end(), std::ostream_iterator<std::string>(std::cerr, ", "));
304 std::cerr << std::endl;
305 }
306
b3d44315
MV
307 if (WEXITSTATUS(status) == 0)
308 {
4e03c47d
DK
309 if (keyIsID)
310 {
311 // gpgv will report success, but we want to enforce a certain keyring
312 // so if we haven't found the key the valid we found is in fact invalid
313 if (GoodSigners.empty())
314 return _("At least one invalid signature was encountered.");
315 }
316 else
317 {
318 if (GoodSigners.empty())
319 return _("Internal error: Good signature, but could not determine key fingerprint?!");
320 }
da9ed163 321 return "";
b3d44315
MV
322 }
323 else if (WEXITSTATUS(status) == 1)
339690e4 324 return _("At least one invalid signature was encountered.");
b3d44315 325 else if (WEXITSTATUS(status) == 111)
b39bb552 326 return _("Could not execute 'apt-key' to verify signature (is gnupg installed?)");
ae99ce2e 327 else if (WEXITSTATUS(status) == 112)
b3d44315 328 {
ae99ce2e
DK
329 // acquire system checks for "NODATA" to generate GPG errors (the others are only warnings)
330 std::string errmsg;
331 //TRANSLATORS: %s is a single techy word like 'NODATA'
332 strprintf(errmsg, _("Clearsigned file isn't valid, got '%s' (does the network require authentication?)"), "NODATA");
333 return errmsg;
b3d44315
MV
334 }
335 else
b39bb552 336 return _("Unknown error executing apt-key");
b3d44315
MV
337}
338
b0d40854 339bool GPGVMethod::URIAcquire(std::string const &Message, FetchItem *Itm)
b3d44315 340{
b0d40854
DK
341 URI const Get = Itm->Uri;
342 string const Path = Get.Host + Get.Path; // To account for relative paths
343 std::string const key = LookupTag(Message, "Signed-By");
b3d44315
MV
344 vector<string> GoodSigners;
345 vector<string> BadSigners;
c5d8878d
MV
346 // a worthless signature is a expired or revoked one
347 vector<string> WorthlessSigners;
349c5c89 348 vector<Signer> SoonWorthlessSigners;
b3d44315
MV
349 vector<string> NoPubKeySigners;
350
351 FetchResult Res;
352 Res.Filename = Itm->DestFile;
353 URIStart(Res);
354
b39bb552 355 // Run apt-key on file, extract contents and get the key ID of the signer
b0d40854 356 string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), key,
c5d8878d 357 GoodSigners, BadSigners, WorthlessSigners,
07ea3af0
JAK
358 SoonWorthlessSigners, NoPubKeySigners);
359
8fa99570
DK
360 // Check if all good signers are soon worthless and warn in that case
361 if (std::all_of(GoodSigners.begin(), GoodSigners.end(), [&](std::string const &good) {
362 return std::any_of(SoonWorthlessSigners.begin(), SoonWorthlessSigners.end(), [&](Signer const &weak) {
08b7761a 363 return IsTheSameKey(weak.key, good);
8fa99570
DK
364 });
365 }))
366 {
07ea3af0
JAK
367 for (auto const & Signer : SoonWorthlessSigners)
368 // TRANSLATORS: The second %s is the reason and is untranslated for repository owners.
5f060c27 369 Warning(_("Signature by key %s uses weak digest algorithm (%s)"), Signer.key.c_str(), Signer.note.c_str());
07ea3af0
JAK
370 }
371
b3d44315
MV
372 if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty())
373 {
374 string errmsg;
375 // In this case, something bad probably happened, so we just go
376 // with what the other method gave us for an error message.
c5d8878d 377 if (BadSigners.empty() && WorthlessSigners.empty() && NoPubKeySigners.empty())
b3d44315
MV
378 errmsg = msg;
379 else
380 {
381 if (!BadSigners.empty())
382 {
339690e4 383 errmsg += _("The following signatures were invalid:\n");
b3d44315 384 for (vector<string>::iterator I = BadSigners.begin();
f7f0d6c7 385 I != BadSigners.end(); ++I)
b3d44315
MV
386 errmsg += (*I + "\n");
387 }
c5d8878d
MV
388 if (!WorthlessSigners.empty())
389 {
390 errmsg += _("The following signatures were invalid:\n");
391 for (vector<string>::iterator I = WorthlessSigners.begin();
f7f0d6c7 392 I != WorthlessSigners.end(); ++I)
c5d8878d
MV
393 errmsg += (*I + "\n");
394 }
b3d44315
MV
395 if (!NoPubKeySigners.empty())
396 {
339690e4 397 errmsg += _("The following signatures couldn't be verified because the public key is not available:\n");
b3d44315 398 for (vector<string>::iterator I = NoPubKeySigners.begin();
f7f0d6c7 399 I != NoPubKeySigners.end(); ++I)
b3d44315
MV
400 errmsg += (*I + "\n");
401 }
402 }
ce424cd4
MV
403 // this is only fatal if we have no good sigs or if we have at
404 // least one bad signature. good signatures and NoPubKey signatures
405 // happen easily when a file is signed with multiple signatures
406 if(GoodSigners.empty() or !BadSigners.empty())
f23153d0 407 return _error->Error("%s", errmsg.c_str());
b3d44315
MV
408 }
409
b3d44315
MV
410 // Just pass the raw output up, because passing it as a real data
411 // structure is too difficult with the method stuff. We keep it
412 // as three separate vectors for future extensibility.
413 Res.GPGVOutput = GoodSigners;
414 Res.GPGVOutput.insert(Res.GPGVOutput.end(),BadSigners.begin(),BadSigners.end());
415 Res.GPGVOutput.insert(Res.GPGVOutput.end(),NoPubKeySigners.begin(),NoPubKeySigners.end());
416 URIDone(Res);
417
418 if (_config->FindB("Debug::Acquire::gpgv", false))
419 {
b39bb552 420 std::clog << "apt-key succeeded\n";
b3d44315
MV
421 }
422
423 return true;
424}
425
426
427int main()
428{
339690e4 429 setlocale(LC_ALL, "");
3927c6da 430
b3d44315
MV
431 GPGVMethod Mth;
432
433 return Mth.Run();
434}