folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
rpm/lib/rpmvs.c

494 lines
12 KiB
C
Raw Normal View History

Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
#include "system.h"
#include <rpm/rpmkeyring.h>
#include "lib/rpmvs.h"
#include "rpmio/digest.h"
#include "debug.h"
struct rpmvs_s {
struct rpmsinfo_s *sigs;
int nsigs;
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
int nalloced;
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
rpmVSFlags vsflags;
Store digest bundle handle in verify set as part of initialization Passing different digest bundles to individual rpmvsInitDigests() and rpmvsVerifyItems() calls would not make any sense, it would simply fail to perform anything meaningful. Eliminating that possibility is the only sane thing to do.
2018-04-06 19:12:48 +08:00
rpmDigestBundle bundle;
Store keyring handle in verify set as part of creation Passing different keyrings to individual calls of rpmvsVerifyItems() on the same set just would not make any sense, eliminating the possibility is the only sane thing. Part of create instead of init as keyring lifetimes are longer than verify sets.
2018-04-06 19:17:25 +08:00
rpmKeyring keyring;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
};
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
struct vfytag_s {
rpmTagVal tag;
rpmTagType tagtype;
rpm_count_t tagcount;
rpm_count_t tagsize;
};
static const struct vfytag_s rpmvfytags[] = {
{ RPMSIGTAG_SIZE, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_PGP, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_MD5, RPM_BIN_TYPE, 0, 16, },
{ RPMSIGTAG_GPG, RPM_BIN_TYPE, 0, 0, },
{ RPMSIGTAG_PAYLOADSIZE, RPM_INT32_TYPE, 1, 4, },
{ RPMSIGTAG_RESERVEDSPACE, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_DSAHEADER, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_RSAHEADER, RPM_BIN_TYPE, 0, 0, },
{ RPMTAG_SHA1HEADER, RPM_STRING_TYPE, 1, 41, },
{ RPMSIGTAG_LONGSIZE, RPM_INT64_TYPE, 1, 8, },
{ RPMSIGTAG_LONGARCHIVESIZE, RPM_INT64_TYPE, 1, 8, },
{ RPMTAG_SHA256HEADER, RPM_STRING_TYPE, 1, 65, },
{ RPMTAG_PAYLOADDIGEST, RPM_STRING_ARRAY_TYPE, 0, 0, },
{ 0 } /* sentinel */
};
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
struct vfyinfo_s {
rpmTagVal tag;
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
int sigh;
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
struct rpmsinfo_s vi;
};
static const struct vfyinfo_s rpmvfyitems[] = {
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_SIZE, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_PGP, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NORSA,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, PGPPUBKEYALGO_RSA, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_MD5, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOMD5,
(RPMSIG_HEADER|RPMSIG_PAYLOAD), PGPHASHALGO_MD5, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_GPG, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NODSA,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, PGPPUBKEYALGO_DSA, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_PAYLOADSIZE, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_PAYLOAD), 0, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_RESERVEDSPACE, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
0, 0, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMTAG_DSAHEADER, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NODSAHEADER,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER), 0, PGPPUBKEYALGO_DSA, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMTAG_RSAHEADER, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_SIGNATURE_TYPE, RPMVSF_NORSAHEADER,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER), 0, PGPPUBKEYALGO_RSA, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMTAG_SHA1HEADER, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOSHA1HEADER,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER), PGPHASHALGO_SHA1, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_LONGSIZE, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMSIGTAG_LONGARCHIVESIZE, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_OTHER_TYPE, 0,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER|RPMSIG_PAYLOAD), 0, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMTAG_SHA256HEADER, 1,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOSHA256HEADER,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_HEADER), PGPHASHALGO_SHA256, 0, }, },
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
{ RPMTAG_PAYLOADDIGEST, 0,
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
{ RPMSIG_DIGEST_TYPE, RPMVSF_NOPAYLOAD,
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
(RPMSIG_PAYLOAD), PGPHASHALGO_SHA256, 0, }, },
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{ 0 } /* sentinel */
};
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
static const char *rangeName(int range);
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
static const char * rpmSigString(rpmRC res);
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
static void rpmVerifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo);
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
static int sinfoLookup(rpmTagVal tag)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
const struct vfyinfo_s *start = &rpmvfyitems[0];
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
int ix = -1;
Eliminate "tag" from rpmsinfo struct Signatures are signatures and digests are digests no matter where they come from, fade out the origins to the extent we can. The id for hashable items is of course still derived from the tag and can be backtraced (ditto for the disabler bits) but it's not exactly full anonymity we need either, and eg id being related to the tag could be useful for debugging.
2017-05-15 16:44:47 +08:00
for (const struct vfyinfo_s *si = start; si->tag; si++) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
if (tag == si->tag) {
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
ix = si - start;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
break;
}
}
Change sinfoLookup() to return an index into rpmvfyitems Not supposed to change any behavior, just preparing for the next steps.
2017-05-11 15:18:00 +08:00
return ix;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Split out hex validity checking to helper function, enhance Besides testing for valid characters, also test for legal length: always divisible by two, at least sha-1 size.
2017-05-30 15:16:05 +08:00
static int validHex(const char *str, size_t slen)
{
int valid = 0; /* Assume invalid */
const char *b;
/* Our hex data is always even sized and at least sha-1 long */
if (slen % 2 || slen < 40)
goto exit;
for (b = str ; *b != '\0'; b++) {
if (strchr("0123456789abcdefABCDEF", *b) == NULL)
goto exit;
}
valid = 1;
exit:
return valid;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static void rpmsinfoInit(const struct vfyinfo_s *vinfo,
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
const struct vfytag_s *tinfo,
rpmtd td, const char *origin,
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
rpmRC rc = RPMRC_FAIL;
const void *data = NULL;
rpm_count_t dlen = 0;
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
*sinfo = vinfo->vi; /* struct assignment */
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
if (td == NULL) {
rc = RPMRC_NOTFOUND;
goto exit;
}
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagtype && tinfo->tagtype != td->type) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid type %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->type);
goto exit;
}
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagcount && tinfo->tagcount != td->count) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s: tag %u: invalid count %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->count);
goto exit;
}
switch (td->type) {
case RPM_STRING_TYPE:
case RPM_STRING_ARRAY_TYPE:
data = rpmtdGetString(td);
if (data)
dlen = strlen(data);
break;
case RPM_BIN_TYPE:
data = td->data;
dlen = td->count;
break;
}
/* MD5 has data length of 16, everything else is (much) larger */
if (sinfo->hashalgo && (data == NULL || dlen < 16)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid data %p (%u)"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, data, dlen);
goto exit;
}
if (td->type == RPM_STRING_TYPE && td->size == 0)
td->size = dlen + 1;
Split tag-specific information out of rpmsinfo struct Commit d809fd525228f015104bf35dfd593a8081debeb3 lumped everything into rpmsinfo but things like tag data type and count don't belong there, it's not interesting once the tag data has been validated. Whether the tag value belongs there is another question, leaving it for now at least as it's used for output in signature checking. No functional changes intended.
2017-05-11 15:40:28 +08:00
if (tinfo->tagsize && (td->flags & RPMTD_IMMUTABLE) &&
tinfo->tagsize != td->size) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid size %u"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag, td->size);
goto exit;
}
if (sinfo->type == RPMSIG_SIGNATURE_TYPE) {
if (pgpPrtParams(data, dlen, PGPTAG_SIGNATURE, &sinfo->sig)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, _("%s tag %u: invalid OpenPGP signature"),
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
origin, td->tag);
goto exit;
}
sinfo->hashalgo = pgpDigParamsAlgo(sinfo->sig, PGPVAL_HASHALGO);
sinfo->keyid = pgpGrab(sinfo->sig->signid+4, 4);
} else if (sinfo->type == RPMSIG_DIGEST_TYPE) {
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
if (td->type == RPM_BIN_TYPE) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sinfo->dig = pgpHexStr(data, dlen);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
} else {
if (!validHex(data, dlen)) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg,
_("%s: tag %u: invalid hex"), origin, td->tag);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
goto exit;
}
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sinfo->dig = xstrdup(data);
Only non-binary digests have hex strings to validate
2017-05-30 17:31:49 +08:00
}
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
if (sinfo->hashalgo)
Account for arrays when generating verify item id Currently we only have one digest/signature per tag but that might change, account for this in the way we generate the id number: tag goes in the high 16 bits, array index into low 16 bits. I have some trouble seeing anybody needing more than 65536 signatures on a package...
2017-05-15 16:14:18 +08:00
sinfo->id = (td->tag << 16) | rpmtdGetIndex(td);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
rc = RPMRC_OK;
exit:
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
sinfo->rc = rc;
return;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
static void rpmsinfoFini(struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (sinfo) {
if (sinfo->type == RPMSIG_SIGNATURE_TYPE)
pgpDigParamsFree(sinfo->sig);
else if (sinfo->type == RPMSIG_DIGEST_TYPE)
free(sinfo->dig);
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
rpmDigestFinal(sinfo->ctx, NULL, NULL, 0);
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
free(sinfo->msg);
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
free(sinfo->descr);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
memset(sinfo, 0, sizeof(*sinfo));
}
}
Bury remaining internal signature API inside rpmvs.c
2017-05-12 18:05:20 +08:00
static int rpmsinfoDisabled(const struct rpmsinfo_s *sinfo, rpmVSFlags vsflags)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (!(sinfo->type & RPMSIG_VERIFIABLE_TYPE))
return 1;
if (vsflags & sinfo->disabler)
return 1;
if ((vsflags & RPMVSF_NEEDPAYLOAD) && (sinfo->range & RPMSIG_PAYLOAD))
return 1;
return 0;
}
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
static void rpmvsReserve(struct rpmvs_s *vs, int n)
{
if (vs->nsigs + n >= vs->nalloced) {
vs->nalloced = (vs->nsigs * 2) + n;
vs->sigs = xrealloc(vs->sigs, vs->nalloced * sizeof(*vs->sigs));
}
}
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
const char *rpmsinfoDescr(struct rpmsinfo_s *sinfo)
{
if (sinfo->descr == NULL) {
switch (sinfo->type) {
case RPMSIG_DIGEST_TYPE:
rasprintf(&sinfo->descr, _("%s%s %s"),
rangeName(sinfo->range),
pgpValString(PGPVAL_HASHALGO, sinfo->hashalgo),
_("digest"));
break;
case RPMSIG_SIGNATURE_TYPE:
Identify non-present signatures too (based on their assumed algo) This is dumb, we should just call them OpenPGP signatures which is what they are, but for now lets just make do with minimum fuss.
2018-04-13 20:08:09 +08:00
if (sinfo->sig) {
rasprintf(&sinfo->descr, _("%s%s"),
rangeName(sinfo->range), pgpIdentItem(sinfo->sig));
} else {
rasprintf(&sinfo->descr, _("%s%s %s"),
rangeName(sinfo->range),
pgpValString(PGPVAL_PUBKEYALGO, sinfo->sigalgo),
_("signature"));
}
Start separating verify item description from its result Add internal API to get a textual description of signature/digest, use where appropriate for formatting the verbose messages.
2017-05-24 16:20:35 +08:00
break;
}
}
return sinfo->descr;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
char *rpmsinfoMsg(struct rpmsinfo_s *sinfo)
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
{
char *msg = NULL;
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->msg) {
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
rasprintf(&msg, "%s: %s (%s)",
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rpmsinfoDescr(sinfo), rpmSigString(sinfo->rc), sinfo->msg);
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
} else {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&msg, "%s: %s",
rpmsinfoDescr(sinfo), rpmSigString(sinfo->rc));
Separate sig/dig verify results from verbose error messages Add and use an internal helper for formatting the verbose messages from callbacks, this gives us nicer and more uniform messages for data that failed to initialize at all. It's also ends up involving more rasprintf()'s and whatnot per result but that can be tuned later.
2017-05-24 17:17:46 +08:00
}
return msg;
}
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
static void rpmvsAppend(struct rpmvs_s *sis, hdrblob blob,
const struct vfyinfo_s *vi, const struct vfytag_s *ti)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
if (!(vi->vi.type & RPMSIG_VERIFIABLE_TYPE))
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
return;
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
const char *o = (blob->il > blob->ril) ? _("header") : _("package");
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmtd_s td;
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
rpmRC rc = hdrblobGet(blob, vi->tag, &td);
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
int nitems = (rc == RPMRC_OK) ? rpmtdCount(&td) : 1;
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
rpmvsReserve(sis, nitems);
Handle dynamic reallocation in rpmvsAppend() Preallocate a little but (for now) so little that reallocation always takes place so it doesn't rot while surroundings still change.
2017-05-22 17:32:32 +08:00
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
if (!rpmsinfoDisabled(&vi->vi, sis->vsflags) && rc == RPMRC_OK) {
while (rpmtdNext(&td) >= 0) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rpmsinfoInit(vi, ti, &td, o, &sis->sigs[sis->nsigs]);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
sis->nsigs++;
}
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
} else {
rpmsinfoInit(vi, ti, NULL, o, &sis->sigs[sis->nsigs]);
sis->nsigs++;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
rpmtdFreeData(&td);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
void rpmvsAppendTag(struct rpmvs_s *vs, hdrblob blob, rpmTagVal tag)
{
int ix = sinfoLookup(tag);
if (ix >= 0) {
const struct vfyinfo_s *vi = &rpmvfyitems[ix];
const struct vfytag_s *ti = &rpmvfytags[ix];
rpmvsAppend(vs, blob, vi, ti);
}
}
Store keyring handle in verify set as part of creation Passing different keyrings to individual calls of rpmvsVerifyItems() on the same set just would not make any sense, eliminating the possibility is the only sane thing. Part of create instead of init as keyring lifetimes are longer than verify sets.
2018-04-06 19:17:25 +08:00
struct rpmvs_s *rpmvsCreate(rpmVSFlags vsflags, rpmKeyring keyring)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
struct rpmvs_s *sis = xcalloc(1, sizeof(*sis));
Always honor vsflags when appending new items to verify set Remember the vsflags passed to us in rpmvsCreate(), check for disabled in rpmvsAppend() instead.
2018-04-05 19:10:37 +08:00
sis->vsflags = vsflags;
Store keyring handle in verify set as part of creation Passing different keyrings to individual calls of rpmvsVerifyItems() on the same set just would not make any sense, eliminating the possibility is the only sane thing. Part of create instead of init as keyring lifetimes are longer than verify sets.
2018-04-06 19:17:25 +08:00
sis->keyring = rpmKeyringLink(keyring);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Split verify set creation to separate allocation + init steps This seems mostly like lotsa trouble for no payback in the current code, but we'll eventually want vs sets to outlive the actual package read stage (to support post-processing of the results), which is when this starts making sense.
2018-04-06 19:03:33 +08:00
return sis;
}
Add getter for verify set vsflags, use it for the one external access It's klunky and shouldn't be needed with a saner API for processing through the data but it'll have to do for now.
2018-04-06 19:28:18 +08:00
rpmVSFlags rpmvsFlags(struct rpmvs_s *vs)
{
return vs->vsflags;
}
Store digest bundle handle in verify set as part of initialization Passing different digest bundles to individual rpmvsInitDigests() and rpmvsVerifyItems() calls would not make any sense, it would simply fail to perform anything meaningful. Eliminating that possibility is the only sane thing to do.
2018-04-06 19:12:48 +08:00
void rpmvsInit(struct rpmvs_s *vs, hdrblob blob, rpmDigestBundle bundle)
Split verify set creation to separate allocation + init steps This seems mostly like lotsa trouble for no payback in the current code, but we'll eventually want vs sets to outlive the actual package read stage (to support post-processing of the results), which is when this starts making sense.
2018-04-06 19:03:33 +08:00
{
const struct vfyinfo_s *si = &rpmvfyitems[0];
const struct vfytag_s *ti = &rpmvfytags[0];
Streamline digest/signature info initialization rpmsinfoInit() never gets called with an unknown value as it's us calling it based on values in our built-in tables (it used to be different though). In fact it mostly gets called while we're walking the very same table we're then looking up again in rpmsinfoInit()... makes no sense whatsoever. Change the internal API to take the table values directly, and handle the lookup in the only case that needs it (payload digest). Not supposed to change any functionality except make things a little saner and faster too.
2018-04-05 18:58:44 +08:00
for (; si->tag && ti->tag; si++, ti++) {
Ignore non-signature tags on rpmvsInit() This avoids tags tags that only exist in the main header from being initialized twice. Currently only RPMTAG_PAYLOADDIGEST is affected.
2018-04-13 18:35:25 +08:00
/* Ignore non-signature tags initially */
if (!si->sigh)
continue;
Split verify set creation to separate allocation + init steps This seems mostly like lotsa trouble for no payback in the current code, but we'll eventually want vs sets to outlive the actual package read stage (to support post-processing of the results), which is when this starts making sense.
2018-04-06 19:03:33 +08:00
rpmvsAppend(vs, blob, si, ti);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
Store digest bundle handle in verify set as part of initialization Passing different digest bundles to individual rpmvsInitDigests() and rpmvsVerifyItems() calls would not make any sense, it would simply fail to perform anything meaningful. Eliminating that possibility is the only sane thing to do.
2018-04-06 19:12:48 +08:00
vs->bundle = bundle;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
struct rpmvs_s *rpmvsFree(struct rpmvs_s *sis)
{
if (sis) {
Store keyring handle in verify set as part of creation Passing different keyrings to individual calls of rpmvsVerifyItems() on the same set just would not make any sense, eliminating the possibility is the only sane thing. Part of create instead of init as keyring lifetimes are longer than verify sets.
2018-04-06 19:17:25 +08:00
rpmKeyringFree(sis->keyring);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
for (int i = 0; i < sis->nsigs; i++) {
rpmsinfoFini(&sis->sigs[i]);
}
free(sis->sigs);
free(sis);
}
return NULL;
}
Separate signature/digest verification from the digest finalization Adjust the API a bit to make things clearer/saner (hopefully): we now init and finalize *ranges*, and verification is an independent, non-destructive operation that can be performed on given *types* of items, allowing separate digest and signature verification and can be performed multiple times without rereading data (for eg added keys). At least in theory... which is to say no such things are done here, this is not supposed to change any visible functionality. For now at least, sort the items in rpmvsVerifyItems() by range to preserve traditional rpm -Kv output.
2018-04-10 16:46:44 +08:00
void rpmvsInitRange(struct rpmvs_s *sis, int range)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
for (int i = 0; i < sis->nsigs; i++) {
struct rpmsinfo_s *sinfo = &sis->sigs[i];
if (sinfo->range & range) {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->rc == RPMRC_OK)
Store digest bundle handle in verify set as part of initialization Passing different digest bundles to individual rpmvsInitDigests() and rpmvsVerifyItems() calls would not make any sense, it would simply fail to perform anything meaningful. Eliminating that possibility is the only sane thing to do.
2018-04-06 19:12:48 +08:00
rpmDigestBundleAddID(sis->bundle, sinfo->hashalgo, sinfo->id, 0);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
}
}
Separate signature/digest verification from the digest finalization Adjust the API a bit to make things clearer/saner (hopefully): we now init and finalize *ranges*, and verification is an independent, non-destructive operation that can be performed on given *types* of items, allowing separate digest and signature verification and can be performed multiple times without rereading data (for eg added keys). At least in theory... which is to say no such things are done here, this is not supposed to change any visible functionality. For now at least, sort the items in rpmvsVerifyItems() by range to preserve traditional rpm -Kv output.
2018-04-10 16:46:44 +08:00
void rpmvsFiniRange(struct rpmvs_s *sis, int range)
{
for (int i = 0; i < sis->nsigs; i++) {
struct rpmsinfo_s *sinfo = &sis->sigs[i];
if (sinfo->range == range && sinfo->rc == RPMRC_OK) {
sinfo->ctx = rpmDigestBundleDupCtx(sis->bundle, sinfo->id);
rpmDigestBundleFinal(sis->bundle, sinfo->id, NULL, NULL, 0);
}
}
}
static int rangeCmp(const void *a, const void *b)
{
const struct rpmsinfo_s *sa = a;
const struct rpmsinfo_s *sb = b;
return sa->range - sb->range;
}
int rpmvsVerifyItems(struct rpmvs_s *sis, int type,
Store keyring handle in verify set as part of creation Passing different keyrings to individual calls of rpmvsVerifyItems() on the same set just would not make any sense, eliminating the possibility is the only sane thing. Part of create instead of init as keyring lifetimes are longer than verify sets.
2018-04-06 19:17:25 +08:00
rpmsinfoCb cb, void *cbdata)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
int failed = 0;
Allow verification callbacks to signal stopping, document the callback Move the rc code from return value to a parameter, change to a pointer to allow modification from the callback. Make the message modifiable from callback too if only for consistency. Change the parameter names on all callback users to force all relevant places to be updated. With all this, a verification callback now force verification to abort by returning 0. No actual behavior is changed in this commit though.
2018-03-08 19:22:49 +08:00
int cont = 1;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Separate signature/digest verification from the digest finalization Adjust the API a bit to make things clearer/saner (hopefully): we now init and finalize *ranges*, and verification is an independent, non-destructive operation that can be performed on given *types* of items, allowing separate digest and signature verification and can be performed multiple times without rereading data (for eg added keys). At least in theory... which is to say no such things are done here, this is not supposed to change any visible functionality. For now at least, sort the items in rpmvsVerifyItems() by range to preserve traditional rpm -Kv output.
2018-04-10 16:46:44 +08:00
/* sort by range to preserve traditional rpm -Kv output */
qsort(sis->sigs, sis->nsigs, sizeof(*sis->sigs), rangeCmp);
Allow verification callbacks to signal stopping, document the callback Move the rc code from return value to a parameter, change to a pointer to allow modification from the callback. Make the message modifiable from callback too if only for consistency. Change the parameter names on all callback users to force all relevant places to be updated. With all this, a verification callback now force verification to abort by returning 0. No actual behavior is changed in this commit though.
2018-03-08 19:22:49 +08:00
for (int i = 0; i < sis->nsigs && cont; i++) {
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
struct rpmsinfo_s *sinfo = &sis->sigs[i];
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
/* Ignore non-present items for now */
if (sinfo->rc == RPMRC_NOTFOUND)
continue;
Separate signature/digest verification from the digest finalization Adjust the API a bit to make things clearer/saner (hopefully): we now init and finalize *ranges*, and verification is an independent, non-destructive operation that can be performed on given *types* of items, allowing separate digest and signature verification and can be performed multiple times without rereading data (for eg added keys). At least in theory... which is to say no such things are done here, this is not supposed to change any visible functionality. For now at least, sort the items in rpmvsVerifyItems() by range to preserve traditional rpm -Kv output.
2018-04-10 16:46:44 +08:00
if (type & sinfo->type) {
Attempt to (re)verify anything that has a digest context This should allow actually rerunning verification after eg importing new keys, previously we would've only looked at the results which were deemed OK already, duh.
2018-04-19 17:30:21 +08:00
if (sinfo->ctx)
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
rpmVerifySignature(sis->keyring, sinfo);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
if (cb)
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
cont = cb(sinfo, cbdata);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
if (sinfo->rc != RPMRC_OK)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
failed++;
}
}
return failed;
}
static const char * rpmSigString(rpmRC res)
{
const char * str;
switch (res) {
case RPMRC_OK: str = "OK"; break;
case RPMRC_FAIL: str = "BAD"; break;
case RPMRC_NOKEY: str = "NOKEY"; break;
case RPMRC_NOTTRUSTED: str = "NOTTRUSTED"; break;
Preliminaries for reporting non-present verification items Remember RPMRC_NOTFOUND results in verify set, but ignore them in actual results for now. The check for verifiable types never really belonged to rpmsinfoDisabled() as it's a different kind of check, and here we see why - we NEVER want to add non-verifiable elements to verify set, but for the next steps we'll need to handle disabled items as if they were not present - ie NOTFOUND. No functionality is supposed to change here.
2018-04-24 16:05:35 +08:00
case RPMRC_NOTFOUND: str = "NOTFOUND"; break;
default: str = "UNKNOWN"; break;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
return str;
}
static const char *rangeName(int range)
{
switch (range) {
case RPMSIG_HEADER: return _("Header ");
case RPMSIG_PAYLOAD: return _("Payload ");
}
/* trad. output for (RPMSIG_HEADER|RPMSIG_PAYLOAD) range is "" */
return "";
}
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
static rpmRC verifyDigest(struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
rpmRC res = RPMRC_FAIL; /* assume failure */
char * dig = NULL;
size_t diglen = 0;
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
DIGEST_CTX ctx = rpmDigestDup(sinfo->ctx);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
Format verbose message strings centrally in rpmVerifySignature() Another step towards separating descriptions from result messages, handle formatting centrally. This also drops the strange "BAD PARAMETERS" message which now fits in even less than it did before: it didn't really know whether it was "uhhuh, s*** happened" internal error or actual validation error. rpmVerifySignature() only gets called for known, pre-validated data now so let it think everything is just a validation failure.
2017-05-24 16:23:48 +08:00
if (rpmDigestFinal(ctx, (void **)&dig, &diglen, 1) || diglen == 0)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
goto exit;
if (strcasecmp(sinfo->dig, dig) == 0) {
res = RPMRC_OK;
} else {
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
rasprintf(&sinfo->msg, "Expected %s != %s", sinfo->dig, dig);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}
exit:
free(dig);
return res;
}
/**
* Verify DSA/RSA signature.
* @param keyring pubkey keyring
* @param sinfo OpenPGP signature parameters
* @return RPMRC_OK on success
*/
static rpmRC
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
verifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
rpmRC res = rpmKeyringVerifySig(keyring, sinfo->sig, sinfo->ctx);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
return res;
}
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
static void
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
rpmVerifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo)
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
{
if (sinfo->type == RPMSIG_DIGEST_TYPE)
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
sinfo->rc = verifyDigest(sinfo);
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
else if (sinfo->type == RPMSIG_SIGNATURE_TYPE)
Remember unfinalized digest context in rpmsinfo struct Less parameters to pass around, the digest context is a rather fundamental part of the sig/dig thing anyway. More importantly this detaches the digest finalization from the actual verification, which allows us to verify later or even multiple times (eg for added keys) without rereading the actual data. No functional changes here though.
2018-04-10 16:24:19 +08:00
sinfo->rc = verifySignature(keyring, sinfo);
Store digest/signature verify results in the sinfo struct directly Makes all sorts of things a whole lotta simple and saner. No actual functional changes here, apart from the internal API changes.
2018-04-05 19:46:36 +08:00
else
sinfo->rc = RPMRC_FAIL;
Lift all the new signature stuff into new rpmvs.[ch] source + header Looks large but this is just moving things around, except for a couple of things changing scope: rpmvsInitDigests() and VerifyItems() become non-static, rpmvfyitems array and rpmvs_s struct details become hidden inside rpmvs.c. signature.[ch] is now merely the largely obsoletish functions for reading and writing a signature header, all the verification business is in rpmvs.
2017-04-28 15:32:24 +08:00
}