fix from David Kalnischkies for the InRelease gpg verification

[apt.git] / apt-pkg / indexcopy.cc

diff --git a/apt-pkg/indexcopy.cc b/apt-pkg/indexcopy.cc
index a2a1d59347ecbbda5bb9a5f5a4d85eaac63dfbf8..31c577705ebbb1ebe0e7dabf7efc856f5c527e6a 100644 (file)
--- a/apt-pkg/indexcopy.cc
+++ b/apt-pkg/indexcopy.cc
@@ -75,7 +75,7 @@ bool IndexCopy::CopyPackages(string CDROM,string Name,vector<string> &List,
       
       // Open the package file
       FileFd Pkg;
-      if (FileExists(*I + GetFileName()) == true)
+      if (RealFileExists(*I + GetFileName()) == true)
       {
         Pkg.Open(*I + GetFileName(),FileFd::ReadOnly);
         FileSize = Pkg.Size();
@@ -132,9 +132,14 @@ bool IndexCopy::CopyPackages(string CDROM,string Name,vector<string> &List,
               (*I).c_str() + CDROM.length(),GetFileName());
       string TargetF = _config->FindDir("Dir::State::lists") + "partial/";
       TargetF += URItoFileName(S);
+      FileFd Target;
       if (_config->FindB("APT::CDROM::NoAct",false) == true)
+      {
         TargetF = "/dev/null";
-      FileFd Target(TargetF,FileFd::WriteAtomic);
+         Target.Open(TargetF,FileFd::WriteExists);
+      } else {
+         Target.Open(TargetF,FileFd::WriteAtomic);
+      }
       FILE *TargetFl = fdopen(dup(Target.Fd()),"w");
       if (_error->PendingError() == true)
         return false;
@@ -527,7 +532,7 @@ bool SigVerify::Verify(string prefix, string file, indexRecords *MetaIndex)
    // we skip non-existing files in the verifcation to support a cdrom
    // with no Packages file (just a Package.gz), see LP: #255545
    // (non-existing files are not considered a error)
-   if(!FileExists(prefix+file))
+   if(!RealFileExists(prefix+file))
    {
       _error->Warning(_("Skipping nonexistent file %s"), string(prefix+file).c_str());
       return true;
@@ -596,7 +601,7 @@ bool SigVerify::CopyAndVerify(string CDROM,string Name,vector<string> &SigList,
       string const release = *I+"Release";
 
       // a Release.gpg without a Release should never happen
-      if(FileExists(release) == false)
+      if(RealFileExists(release) == false)
       {
         delete MetaIndex;
         continue;
@@ -659,9 +664,24 @@ bool SigVerify::CopyAndVerify(string CDROM,string Name,vector<string> &SigList,
 bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
                        int const &statusfd, int fd[2])
 {
+   if (File == FileGPG)
+   {
+      #define SIGMSG "-----BEGIN PGP SIGNED MESSAGE-----\n"
+      char buffer[sizeof(SIGMSG)];
+      FILE* gpg = fopen(File.c_str(), "r");
+      if (gpg == NULL)
+        return _error->Errno("RunGPGV", _("Could not open file %s"), File.c_str());
+      char const * const test = fgets(buffer, sizeof(buffer), gpg);
+      fclose(gpg);
+      if (test == NULL || strcmp(buffer, SIGMSG) != 0)
+        return _error->Error(_("File %s doesn't start with a clearsigned message"), File.c_str());
+      #undef SIGMSG
+   }
+
+
    string const gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
    // FIXME: remove support for deprecated APT::GPGV setting
-   string const trustedFile = _config->FindFile("Dir::Etc::Trusted");
+   string const trustedFile = _config->Find("APT::GPGV::TrustedKeyring", _config->FindFile("Dir::Etc::Trusted"));
    string const trustedPath = _config->FindDir("Dir::Etc::TrustedParts");
 
    bool const Debug = _config->FindB("Debug::Acquire::gpgv", false);
@@ -673,15 +693,21 @@ bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
       std::clog << "Keyring path: " << trustedPath << std::endl;
    }
 
-   std::vector<string> keyrings = GetListOfFilesInDir(trustedPath, "gpg", false);
-   if (FileExists(trustedFile) == true)
-      keyrings.push_back(trustedFile);
+   std::vector<string> keyrings;
+   if (DirectoryExists(trustedPath))
+     keyrings = GetListOfFilesInDir(trustedPath, "gpg", false, true);
+   if (RealFileExists(trustedFile) == true)
+     keyrings.push_back(trustedFile);
 
    std::vector<const char *> Args;
    Args.reserve(30);
 
    if (keyrings.empty() == true)
-      return false;
+   {
+      // TRANSLATOR: %s is the trusted keyring parts directory
+      return _error->Error(_("No keyring installed in %s."),
+                          _config->FindDir("Dir::Etc::TrustedParts").c_str());
+   }
 
    Args.push_back(gpgvpath.c_str());
    Args.push_back("--ignore-time-conflict");
@@ -715,7 +741,8 @@ bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
    }
 
    Args.push_back(FileGPG.c_str());
-   Args.push_back(File.c_str());
+   if (FileGPG != File)
+      Args.push_back(File.c_str());
    Args.push_back(NULL);
 
    if (Debug == true)
@@ -780,7 +807,7 @@ bool TranslationsCopy::CopyTranslations(string CDROM,string Name,   /*{{{*/
       
       // Open the package file
       FileFd Pkg;
-      if (FileExists(*I) == true)
+      if (RealFileExists(*I) == true)
       {
         Pkg.Open(*I,FileFd::ReadOnly);
         FileSize = Pkg.Size();