* apt-pkg/init.cc:
[ntk/apt.git] / methods / gpgv.cc
CommitLineData
b3d44315
MV
1#include <apt-pkg/error.h>
2#include <apt-pkg/acquire-method.h>
3#include <apt-pkg/strutl.h>
46e39c8e 4#include <apt-pkg/fileutl.h>
a319c4ee 5#include <apt-pkg/indexcopy.h>
339690e4 6#include <apti18n.h>
b3d44315 7
b3d44315
MV
8#include <utime.h>
9#include <stdio.h>
10#include <fcntl.h>
11#include <errno.h>
12#include <sys/wait.h>
13#include <iostream>
da9ed163 14#include <sstream>
b3d44315 15
f5a3d009
DK
16#include <vector>
17
b3d44315
MV
18#define GNUPGPREFIX "[GNUPG:]"
19#define GNUPGBADSIG "[GNUPG:] BADSIG"
20#define GNUPGNOPUBKEY "[GNUPG:] NO_PUBKEY"
21#define GNUPGVALIDSIG "[GNUPG:] VALIDSIG"
c5d8878d
MV
22#define GNUPGGOODSIG "[GNUPG:] GOODSIG"
23#define GNUPGKEYEXPIRED "[GNUPG:] KEYEXPIRED"
24#define GNUPGREVKEYSIG "[GNUPG:] REVKEYSIG"
2abb68b7 25#define GNUPGNODATA "[GNUPG:] NODATA"
b3d44315
MV
26
27class GPGVMethod : public pkgAcqMethod
28{
29 private:
da9ed163 30 string VerifyGetSigners(const char *file, const char *outfile,
c5d8878d
MV
31 vector<string> &GoodSigners,
32 vector<string> &BadSigners,
33 vector<string> &WorthlessSigners,
b3d44315
MV
34 vector<string> &NoPubKeySigners);
35
36 protected:
37 virtual bool Fetch(FetchItem *Itm);
38
39 public:
40
41 GPGVMethod() : pkgAcqMethod("1.0",SingleInstance | SendConfig) {};
42};
43
da9ed163 44string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
b3d44315
MV
45 vector<string> &GoodSigners,
46 vector<string> &BadSigners,
c5d8878d 47 vector<string> &WorthlessSigners,
b3d44315
MV
48 vector<string> &NoPubKeySigners)
49{
46e39c8e 50 bool const Debug = _config->FindB("Debug::Acquire::gpgv", false);
da9ed163
MV
51 // setup a (empty) stringstream for formating the return value
52 std::stringstream ret;
b2c22075 53 ret.str("");
da9ed163 54
46e39c8e
MV
55 if (Debug == true)
56 std::clog << "inside VerifyGetSigners" << std::endl;
57
b3d44315 58 int fd[2];
46e39c8e 59
b3d44315 60 if (pipe(fd) < 0)
b3d44315 61 return "Couldn't create pipe";
b3d44315 62
cf440fac 63 pid_t pid = fork();
b3d44315 64 if (pid < 0)
da9ed163 65 return string("Couldn't spawn new process") + strerror(errno);
b3d44315
MV
66 else if (pid == 0)
67 {
cf440fac 68 if (SigVerify::RunGPGV(outfile, file, 3, fd) == false)
b3d44315 69 {
cf440fac
DK
70 // TRANSLATOR: %s is the trusted keyring parts directory
71 ioprintf(ret, _("No keyring installed in %s."),
4368851d 72 _config->FindDir("Dir::Etc::TrustedParts").c_str());
cf440fac 73 return ret.str();
b3d44315 74 }
b3d44315
MV
75 exit(111);
76 }
77 close(fd[1]);
78
cf440fac
DK
79 FILE *pipein = fdopen(fd[0], "r");
80
b3d44315
MV
81 // Loop over the output of gpgv, and check the signatures.
82 size_t buffersize = 64;
83 char *buffer = (char *) malloc(buffersize);
84 size_t bufferoff = 0;
85 while (1)
86 {
87 int c;
88
89 // Read a line. Sigh.
90 while ((c = getc(pipein)) != EOF && c != '\n')
91 {
92 if (bufferoff == buffersize)
93 buffer = (char *) realloc(buffer, buffersize *= 2);
94 *(buffer+bufferoff) = c;
95 bufferoff++;
96 }
97 if (bufferoff == 0 && c == EOF)
98 break;
99 *(buffer+bufferoff) = '\0';
100 bufferoff = 0;
46e39c8e
MV
101 if (Debug == true)
102 std::clog << "Read: " << buffer << std::endl;
b3d44315
MV
103
104 // Push the data into three separate vectors, which
105 // we later concatenate. They're kept separate so
106 // if we improve the apt method communication stuff later
107 // it will be better.
108 if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0)
109 {
46e39c8e
MV
110 if (Debug == true)
111 std::clog << "Got BADSIG! " << std::endl;
b3d44315
MV
112 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
113 }
114
115 if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
116 {
46e39c8e
MV
117 if (Debug == true)
118 std::clog << "Got NO_PUBKEY " << std::endl;
b3d44315
MV
119 NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
120 }
2abb68b7
MV
121 if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
122 {
46e39c8e
MV
123 if (Debug == true)
124 std::clog << "Got NODATA! " << std::endl;
2abb68b7
MV
125 BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
126 }
c5d8878d
MV
127 if (strncmp(buffer, GNUPGKEYEXPIRED, sizeof(GNUPGKEYEXPIRED)-1) == 0)
128 {
46e39c8e
MV
129 if (Debug == true)
130 std::clog << "Got KEYEXPIRED! " << std::endl;
c5d8878d
MV
131 WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
132 }
133 if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0)
134 {
46e39c8e
MV
135 if (Debug == true)
136 std::clog << "Got REVKEYSIG! " << std::endl;
c5d8878d
MV
137 WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
138 }
139 if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0)
b3d44315
MV
140 {
141 char *sig = buffer + sizeof(GNUPGPREFIX);
c5d8878d 142 char *p = sig + sizeof("GOODSIG");
b3d44315
MV
143 while (*p && isxdigit(*p))
144 p++;
145 *p = 0;
46e39c8e
MV
146 if (Debug == true)
147 std::clog << "Got GOODSIG, key ID:" << sig << std::endl;
b3d44315
MV
148 GoodSigners.push_back(string(sig));
149 }
150 }
151 fclose(pipein);
152
cf440fac 153 int status;
b3d44315 154 waitpid(pid, &status, 0);
46e39c8e 155 if (Debug == true)
b3d44315 156 {
46e39c8e 157 std::clog << "gpgv exited\n";
b3d44315
MV
158 }
159
160 if (WEXITSTATUS(status) == 0)
161 {
162 if (GoodSigners.empty())
339690e4 163 return _("Internal error: Good signature, but could not determine key fingerprint?!");
da9ed163 164 return "";
b3d44315
MV
165 }
166 else if (WEXITSTATUS(status) == 1)
167 {
339690e4 168 return _("At least one invalid signature was encountered.");
b3d44315
MV
169 }
170 else if (WEXITSTATUS(status) == 111)
171 {
cf440fac 172 ioprintf(ret, _("Could not execute 'gpgv' to verify signature (is gpgv installed?)"));
da9ed163 173 return ret.str();
b3d44315
MV
174 }
175 else
176 {
339690e4 177 return _("Unknown error executing gpgv");
b3d44315
MV
178 }
179}
180
181bool GPGVMethod::Fetch(FetchItem *Itm)
182{
183 URI Get = Itm->Uri;
184 string Path = Get.Host + Get.Path; // To account for relative paths
185 string keyID;
186 vector<string> GoodSigners;
187 vector<string> BadSigners;
c5d8878d
MV
188 // a worthless signature is a expired or revoked one
189 vector<string> WorthlessSigners;
b3d44315
MV
190 vector<string> NoPubKeySigners;
191
192 FetchResult Res;
193 Res.Filename = Itm->DestFile;
194 URIStart(Res);
195
196 // Run gpgv on file, extract contents and get the key ID of the signer
da9ed163 197 string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(),
c5d8878d
MV
198 GoodSigners, BadSigners, WorthlessSigners,
199 NoPubKeySigners);
b3d44315
MV
200 if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty())
201 {
202 string errmsg;
203 // In this case, something bad probably happened, so we just go
204 // with what the other method gave us for an error message.
c5d8878d 205 if (BadSigners.empty() && WorthlessSigners.empty() && NoPubKeySigners.empty())
b3d44315
MV
206 errmsg = msg;
207 else
208 {
209 if (!BadSigners.empty())
210 {
339690e4 211 errmsg += _("The following signatures were invalid:\n");
b3d44315
MV
212 for (vector<string>::iterator I = BadSigners.begin();
213 I != BadSigners.end(); I++)
214 errmsg += (*I + "\n");
215 }
c5d8878d
MV
216 if (!WorthlessSigners.empty())
217 {
218 errmsg += _("The following signatures were invalid:\n");
219 for (vector<string>::iterator I = WorthlessSigners.begin();
220 I != WorthlessSigners.end(); I++)
221 errmsg += (*I + "\n");
222 }
b3d44315
MV
223 if (!NoPubKeySigners.empty())
224 {
339690e4 225 errmsg += _("The following signatures couldn't be verified because the public key is not available:\n");
b3d44315
MV
226 for (vector<string>::iterator I = NoPubKeySigners.begin();
227 I != NoPubKeySigners.end(); I++)
228 errmsg += (*I + "\n");
229 }
230 }
ce424cd4
MV
231 // this is only fatal if we have no good sigs or if we have at
232 // least one bad signature. good signatures and NoPubKey signatures
233 // happen easily when a file is signed with multiple signatures
234 if(GoodSigners.empty() or !BadSigners.empty())
f23153d0 235 return _error->Error("%s", errmsg.c_str());
b3d44315
MV
236 }
237
b3d44315
MV
238 // Just pass the raw output up, because passing it as a real data
239 // structure is too difficult with the method stuff. We keep it
240 // as three separate vectors for future extensibility.
241 Res.GPGVOutput = GoodSigners;
242 Res.GPGVOutput.insert(Res.GPGVOutput.end(),BadSigners.begin(),BadSigners.end());
243 Res.GPGVOutput.insert(Res.GPGVOutput.end(),NoPubKeySigners.begin(),NoPubKeySigners.end());
244 URIDone(Res);
245
246 if (_config->FindB("Debug::Acquire::gpgv", false))
247 {
46e39c8e 248 std::clog << "gpgv succeeded\n";
b3d44315
MV
249 }
250
251 return true;
252}
253
254
255int main()
256{
339690e4
MV
257 setlocale(LC_ALL, "");
258
b3d44315
MV
259 GPGVMethod Mth;
260
261 return Mth.Run();
262}