Skip to content

Commit

Permalink
Drill pubkeys one level deeper into the keystore APIs
Browse files Browse the repository at this point in the history
Pass pubkeys down to the keystore on import, and let the keystore handle
the actual format. For rpmdb keystore this remains the header, so it's a
no-op there, but on the fs keystore we drop the trailing "time or something"
hex garbage from the filename because we no longer have it at hand but
also because it's just not relevant for anything. The key load glob is
relaxed enough that we still pick the old format keys too.

Related: #3342
  • Loading branch information
pmatilai authored and ffesti committed Oct 28, 2024
1 parent 63e3061 commit 781bf3b
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 25 deletions.
47 changes: 25 additions & 22 deletions lib/keystore.cc
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ enum {
KEYRING_FS = 2,
};

static int makePubkeyHeader(rpmts ts, rpmPubkey key, Header * hdrp);

static int rpmtsLoadKeyringFromFiles(rpmts ts, rpmKeyring keyring)
{
ARGV_t files = NULL;
Expand Down Expand Up @@ -63,7 +65,7 @@ static int rpmtsLoadKeyringFromFiles(rpmts ts, rpmKeyring keyring)
static rpmRC rpmtsDeleteFSKey(rpmtxn txn, const string & keyid, const string & newname = "")
{
rpmRC rc = RPMRC_NOTFOUND;
string keyglob = "gpg-pubkey-" + keyid + "-*.key";
string keyglob = "gpg-pubkey-" + keyid + "*.key";
ARGV_t files = NULL;
char *pkpath = rpmGenPath(rpmtxnRootDir(txn), "%{_keyringpath}/", keyglob.c_str());
if (rpmGlob(pkpath, NULL, &files) == 0) {
Expand All @@ -84,11 +86,12 @@ static rpmRC rpmtsDeleteFSKey(rpmtxn txn, rpmPubkey key)
return rpmtsDeleteFSKey(txn, rpmPubkeyFingerprintAsHex(key));
}

static rpmRC rpmtsImportFSKey(rpmtxn txn, Header h, rpmFlags flags, int replace)
static rpmRC rpmtsImportFSKey(rpmtxn txn, rpmPubkey key, rpmFlags flags, int replace)
{
rpmRC rc = RPMRC_FAIL;
char *keyfmt = headerFormat(h, "%{nvr}.key", NULL);
char *keyval = headerGetAsString(h, RPMTAG_DESCRIPTION);
const char *fp = rpmPubkeyFingerprintAsHex(key);
char *keyfmt = rstrscat(NULL, "gpg-pubkey-", fp, ".key", NULL);
char *keyval = rpmPubkeyArmorWrap(key);
char *path = rpmGenPath(rpmtxnRootDir(txn), "%{_keyringpath}/", keyfmt);
char *tmppath = NULL;

Expand Down Expand Up @@ -121,13 +124,10 @@ static rpmRC rpmtsImportFSKey(rpmtxn txn, Header h, rpmFlags flags, int replace)

if (!rc && replace) {
/* find and delete the old pubkey entry */
char *keyid = headerFormat(h, "%{version}", NULL);
if (rpmtsDeleteFSKey(txn, keyid, keyfmt) == RPMRC_NOTFOUND) {
if (rpmtsDeleteFSKey(txn, fp, keyfmt) == RPMRC_NOTFOUND) {
/* make sure an old, short keyid version gets removed */
rpmtsDeleteFSKey(txn, keyid+32, keyfmt);
rpmtsDeleteFSKey(txn, fp+32, keyfmt);
}
free(keyid);

}

exit:
Expand Down Expand Up @@ -208,9 +208,15 @@ static rpmRC rpmtsDeleteDBKey(rpmtxn txn, rpmPubkey key)
return rpmtsDeleteDBKey(txn, rpmPubkeyFingerprintAsHex(key));
}

static rpmRC rpmtsImportDBKey(rpmtxn txn, Header h, rpmFlags flags, int replace)
static rpmRC rpmtsImportDBKey(rpmtxn txn, rpmPubkey key, rpmFlags flags, int replace)
{
rpmRC rc = rpmtsImportHeader(txn, h, 0);
Header h = NULL;
rpmRC rc = RPMRC_FAIL;

if (makePubkeyHeader(rpmtxnTs(txn), key, &h) != 0)
return rc;

rc = rpmtsImportHeader(txn, h, 0);

if (!rc && replace) {
/* find and delete the old pubkey entry */
Expand All @@ -222,6 +228,7 @@ static rpmRC rpmtsImportDBKey(rpmtxn txn, Header h, rpmFlags flags, int replace)
}
free(keyid);
}
headerFree(h);

return rc;
}
Expand Down Expand Up @@ -358,6 +365,11 @@ static int makePubkeyHeader(rpmts ts, rpmPubkey key, Header * hdrp)
if (h != NULL) {
*hdrp = headerLink(h);
rc = 0;

/* Add install time/tid as icing on the cake */
rpm_tid_t tid = rpmtsGetTid(ts);
headerPutUint32(h, RPMTAG_INSTALLTIME, &tid, 1);
headerPutUint32(h, RPMTAG_INSTALLTID, &tid, 1);
}

exit:
Expand All @@ -374,25 +386,16 @@ rpmRC rpmKeystoreImportPubkey(rpmtxn txn, rpmPubkey key, int replace)
{
rpmRC rc = RPMRC_FAIL;
rpmts ts = rpmtxnTs(txn);
Header h = NULL;

if (makePubkeyHeader(ts, key, &h) != 0)
return rc;

rpm_tid_t tid = rpmtsGetTid(ts);
headerPutUint32(h, RPMTAG_INSTALLTIME, &tid, 1);
headerPutUint32(h, RPMTAG_INSTALLTID, &tid, 1);

/* Add header to database. */
if (!(rpmtsFlags(ts) & RPMTRANS_FLAG_TEST)) {
if (ts->keyringtype == KEYRING_FS)
rc = rpmtsImportFSKey(txn, h, 0, replace);
rc = rpmtsImportFSKey(txn, key, 0, replace);
else
rc = rpmtsImportDBKey(txn, h, 0, replace);
rc = rpmtsImportDBKey(txn, key, 0, replace);
} else {
rc = RPMRC_OK;
}
headerFree(h);
return rc;
}

Expand Down
6 changes: 3 additions & 3 deletions tests/rpmsigdig.at
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ echo "%_keyring fs" >> "${RPMTEST}"/root/.rpmmacros

RPMTEST_CHECK([
runroot rpmkeys --import /data/keys/rpm.org-rsa-2048-test.pub
runroot_other mv /var/lib/rpm/pubkeys/gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc-58e63918.key /var/lib/rpm/pubkeys/gpg-pubkey-1964c5fc-58e63918.key
runroot_other mv /var/lib/rpm/pubkeys/gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc.key /var/lib/rpm/pubkeys/gpg-pubkey-1964c5fc-58e63918.key
runroot_other ls /var/lib/rpm/pubkeys/
runroot rpmkeys --list
],
Expand All @@ -180,7 +180,7 @@ RPMTEST_CHECK([
runroot_other ls /var/lib/rpm/pubkeys/
],
[0],
[gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc-58e63918.key
[gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc.key
],
[])
RPMTEST_CLEANUP
Expand Down Expand Up @@ -495,7 +495,7 @@ runroot rpmkeys \
--define "_keyringpath /tmp/kr" \
--define "_keyring fs" \
--import /data/keys/rpm.org-rsa-2048-test.pub
runroot_other cat /tmp/kr/gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc-58e63918.key | grep -v 'Version: '
runroot_other cat /tmp/kr/gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc.key | grep -v 'Version: '
],
[0],
[-----BEGIN PGP PUBLIC KEY BLOCK-----
Expand Down

0 comments on commit 781bf3b

Please sign in to comment.