fix from David Kalnischkies for the InRelease gpg verification

code (LP: #784473)

diff --git a/apt-pkg/indexcopy.cc b/apt-pkg/indexcopy.cc
index 064fb007c9decc7f9670b185d827a4886fc0ca5a..31c577705ebbb1ebe0e7dabf7efc856f5c527e6a 100644 (file)
--- a/apt-pkg/indexcopy.cc
+++ b/apt-pkg/indexcopy.cc
@@ -664,6 +664,21 @@ bool SigVerify::CopyAndVerify(string CDROM,string Name,vector<string> &SigList,
 bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
                        int const &statusfd, int fd[2])
 {
 bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
                        int const &statusfd, int fd[2])
 {

+   if (File == FileGPG)
+   {
+      #define SIGMSG "-----BEGIN PGP SIGNED MESSAGE-----\n"
+      char buffer[sizeof(SIGMSG)];
+      FILE* gpg = fopen(File.c_str(), "r");
+      if (gpg == NULL)
+        return _error->Errno("RunGPGV", _("Could not open file %s"), File.c_str());
+      char const * const test = fgets(buffer, sizeof(buffer), gpg);
+      fclose(gpg);
+      if (test == NULL || strcmp(buffer, SIGMSG) != 0)
+        return _error->Error(_("File %s doesn't start with a clearsigned message"), File.c_str());
+      #undef SIGMSG
+   }
+
+

    string const gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
    // FIXME: remove support for deprecated APT::GPGV setting
    string const trustedFile = _config->Find("APT::GPGV::TrustedKeyring", _config->FindFile("Dir::Etc::Trusted"));
    string const gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
    // FIXME: remove support for deprecated APT::GPGV setting
    string const trustedFile = _config->Find("APT::GPGV::TrustedKeyring", _config->FindFile("Dir::Etc::Trusted"));


@@ -688,7 +703,11 @@ bool SigVerify::RunGPGV(std::string const &File, std::string const &FileGPG,
    Args.reserve(30);
 
    if (keyrings.empty() == true)
    Args.reserve(30);
 
    if (keyrings.empty() == true)

-      return false;
+   {
+      // TRANSLATOR: %s is the trusted keyring parts directory
+      return _error->Error(_("No keyring installed in %s."),
+                          _config->FindDir("Dir::Etc::TrustedParts").c_str());
+   }

 
    Args.push_back(gpgvpath.c_str());
    Args.push_back("--ignore-time-conflict");
 
    Args.push_back(gpgvpath.c_str());
    Args.push_back("--ignore-time-conflict");

diff --git a/debian/changelog b/debian/changelog
index 87d25e78ffdac0406c547b23928284ca2798bb53..244bb83e01d3466d0b2b99b1f93ad42d90fdf1c4 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+apt (0.8.15.2) unstable; urgency=high
+
+  * fix from David Kalnischkies for the InRelease gpg verification 
+    code (LP: #784473)
+
+ -- Michael Vogt <mvo@debian.org>  Tue, 12 Jul 2011 11:54:47 +0200
+

 apt (0.8.15.1) unstable; urgency=low
 
   [ David Kalnischkies ]
 apt (0.8.15.1) unstable; urgency=low
 
   [ David Kalnischkies ]

diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index efe1f73f7415d998b0fd3a4f167bd6db440cd876..960c06180eede581bdb1ebb0ef687189929ba4b3 100644 (file)
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -65,13 +65,16 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
       return string("Couldn't spawn new process") + strerror(errno);
    else if (pid == 0)
    {
       return string("Couldn't spawn new process") + strerror(errno);
    else if (pid == 0)
    {

-      if (SigVerify::RunGPGV(outfile, file, 3, fd) == false)
+      _error->PushToStack();
+      bool const success = SigVerify::RunGPGV(outfile, file, 3, fd);
+      if (success == false)

       {
       {

-        // TRANSLATOR: %s is the trusted keyring parts directory
-        ioprintf(ret, _("No keyring installed in %s."),
-                 _config->FindDir("Dir::Etc::TrustedParts").c_str());
-        return ret.str();
+        string errmsg;
+        _error->PopMessage(errmsg);
+        _error->RevertToStack();
+        return errmsg;

       }
       }

+      _error->RevertToStack();

       exit(111);
    }
    close(fd[1]);
       exit(111);
    }
    close(fd[1]);