folkslinux
/
rpm
mirror of https://github.com/rpm-software-management/rpm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add pgpVerifySignature2() and pgpPrtParams2() 

Add new functions pgpVerifySignature2() and pgpPrtParams2(), which are
like their earlier versions, but optionally return descriptive error
messages (in the case of failure) or lints (in the case of success).
Adjust tests accordingly.

This requires rpm-sequoia 1.4 or later.

See https://github.com/rpm-software-management/rpm-sequoia/issues/39
and
https://github.com/rpm-software-management/rpm/issues/2127#issuecomment-1482646398

Fixes #2483.
This commit is contained in:
Neal H. Walfield 2023-04-12 17:56:19 +02:00 committed by Panu Matilainen
parent 293b625f3a
commit 87b9e0c28c
9 changed files with 116 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ci/Dockerfile
View File

@ -7,6 +7,8 @@ RUN sed -i -e "s:^enabled=.$:enabled=0:g" /etc/yum.repos.d/*openh264.repo
# dummy for controlling per-repo gpgcheck via Semaphore setup
RUN sed -i -e "s:^gpgcheck=.$:gpgcheck=1:g" /etc/yum.repos.d/*.repo
RUN dnf -y update
# until 1.4.0 lands in stable
RUN dnf -y --enablerepo=updates-testing install "rpm-sequoia-devel >= 1.4.0"
RUN dnf -y install \
autoconf \
cmake \

23
include/rpm/rpmpgp.h
View File

@ -1009,6 +1009,18 @@ int pgpPubkeyKeyID(const uint8_t * pkt, size_t pktlen, pgpKeyID_t keyid);
int pgpPrtParams(const uint8_t *pkts, size_t pktlen, unsigned int pkttype,
pgpDigParams * ret);
/** \ingroup rpmpgp
* Parse a OpenPGP packet(s).
* @param pkts OpenPGP packet(s)
* @param pktlen OpenPGP packet(s) length (no. of bytes)
* @param pkttype Expected packet type (signature/key) or 0 for any
* @param[out] ret signature/pubkey packet parameters on success (alloced)
* @param[out] lints error messages and lints
* @return -1 on error, 0 on success
*/
int pgpPrtParams2(const uint8_t *pkts, size_t pktlen, unsigned int pkttype,
pgpDigParams * ret, char **lints);
/** \ingroup rpmpgp
* Parse subkey parameters from OpenPGP packet(s).
* @param pkts OpenPGP packet(s)
@ -1186,6 +1198,17 @@ pgpDigParams pgpDigParamsFree(pgpDigParams digp);
*/
rpmRC pgpVerifySignature(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx);
/** \ingroup rpmpgp
* Verify a PGP signature and return a error message or lint.
* @param key public key
* @param sig signature
* @param hashctx digest context
* @param lints error messages and lints
* @return RPMRC_OK on success
*/
rpmRC pgpVerifySignature2(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx,
char **lints);
/** \ingroup rpmpgp
* Return the type of a PGP signature. If `sig` is NULL, or is not a signature,
* returns -1.

19
lib/rpmvs.c
View File

@ -193,10 +193,23 @@ static void rpmsinfoInit(const struct vfyinfo_s *vinfo,
}
if (sinfo->type == RPMSIG_SIGNATURE_TYPE) {
if (pgpPrtParams(data, dlen, PGPTAG_SIGNATURE, &sinfo->sig)) {
rasprintf(&sinfo->msg, _("%s tag %u: invalid OpenPGP signature"),
origin, td->tag);
char *lints = NULL;
int ec = pgpPrtParams2(data, dlen, PGPTAG_SIGNATURE, &sinfo->sig, &lints);
if (ec) {
if (lints) {
rasprintf(&sinfo->msg,
("%s tag %u: invalid OpenPGP signature: %s"),
origin, td->tag, lints);
free(lints);
} else {
rasprintf(&sinfo->msg,
_("%s tag %u: invalid OpenPGP signature"),
origin, td->tag);
}
goto exit;
} else if (lints) {
rpmlog(RPMLOG_WARNING, "%s\n", lints);
free(lints);
}
sinfo->hashalgo = pgpDigParamsAlgo(sinfo->sig, PGPVAL_HASHALGO);
sinfo->keyid = pgpGrab(pgpDigParamsSignID(sinfo->sig)+4, 4);

2
rpmio/CMakeLists.txt
View File

@ -21,7 +21,7 @@ if (WITH_INTERNAL_OPENPGP)
target_link_libraries(librpmio PRIVATE PkgConfig::LIBGCRYPT)
endif()
else()
pkg_check_modules(RPMSEQUOIA REQUIRED IMPORTED_TARGET rpm-sequoia>=1.3.0)
pkg_check_modules(RPMSEQUOIA REQUIRED IMPORTED_TARGET rpm-sequoia>=1.4.0)
target_sources(librpmio PRIVATE rpmpgp_sequoia.c)
target_link_libraries(librpmio PRIVATE PkgConfig::RPMSEQUOIA)
endif()

7
rpmio/rpmkeyring.c
View File

@ -276,7 +276,12 @@ rpmRC rpmKeyringVerifySig(rpmKeyring keyring, pgpDigParams sig, DIGEST_CTX ctx)
pgpkey = key->pgpkey;
/* We call verify even if key not found for a signature sanity check */
rc = pgpVerifySignature(pgpkey, sig, ctx);
char *lints = NULL;
rc = pgpVerifySignature2(pgpkey, sig, ctx, &lints);
if (lints) {
rpmlog(rc ? RPMLOG_ERR : RPMLOG_WARNING, "%s\n", lints);
free(lints);
}
}
if (keyring)

15
rpmio/rpmpgp_internal.c
View File

@ -1043,6 +1043,14 @@ int pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
return rc;
}
int pgpPrtParams2(const uint8_t * pkts, size_t pktlen, unsigned int pkttype,
pgpDigParams * ret, char **lints)
{
if (lints)
*lints = NULL;
return pgpPrtParams(pkts, pktlen, pkttype, ret);
}
int pgpPrtParamsSubkeys(const uint8_t *pkts, size_t pktlen,
pgpDigParams mainkey, pgpDigParams **subkeys,
int *subkeysCount)
@ -1179,6 +1187,13 @@ exit:
}
rpmRC pgpVerifySignature2(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx, char **lints)
{
if (lints)
*lints = NULL;
return pgpVerifySignature(key, sig, hashctx);
}
static pgpArmor decodePkts(uint8_t *b, uint8_t **pkt, size_t *pktlen)
{
const char * enc = NULL;

7
rpmio/rpmpgp_sequoia.c
View File

@ -36,6 +36,9 @@ W(uint32_t, pgpDigParamsCreationTime, (pgpDigParams digp), (digp))
W(rpmRC, pgpVerifySignature,
(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx),
(key, sig, hashctx))
W(rpmRC, pgpVerifySignature2,
(pgpDigParams key, pgpDigParams sig, DIGEST_CTX hashctx, char **lints),
(key, sig, hashctx, lints))
W(int, pgpPubkeyKeyID,
(const uint8_t * pkt, size_t pktlen, pgpKeyID_t keyid),
(pkt, pktlen, keyid))
@ -51,6 +54,10 @@ W(int, pgpPubKeyCertLen,
W(int, pgpPrtParams,
(const uint8_t *pkts, size_t pktlen, unsigned int pkttype, pgpDigParams *ret),
(pkts, pktlen, pkttype, ret))
W(int, pgpPrtParams2,
(const uint8_t *pkts, size_t pktlen, unsigned int pkttype, pgpDigParams *ret,
char **lints),
(pkts, pktlen, pkttype, ret, lints))
W(int, pgpPrtParamsSubkeys,
(const uint8_t *pkts, size_t pktlen,
pgpDigParams mainkey, pgpDigParams **subkeys,

10
tests/rpmi.at
View File

@ -342,7 +342,7 @@ AT_CLEANUP
AT_SETUP([rpm -U <corrupted signed 1>])
AT_KEYWORDS([install])
AT_CHECK([
AT_CHECK_UNQUOTED([
RPMDB_INIT
pkg="hello-2.0-1.x86_64-signed.rpm"
@ -355,7 +355,13 @@ runroot rpm -U --ignorearch --ignoreos --nodeps \
],
[1],
[],
[error: /tmp/hello-2.0-1.x86_64-signed.rpm: Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)
[`if test x$PGP = xinternal; then
echo 'error: /tmp/hello-2.0-1.x86_64-signed.rpm: Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)'
else
echo 'error: /tmp/hello-2.0-1.x86_64-signed.rpm: Header RSA signature: BAD (package tag 268: invalid OpenPGP signature: Parsing an OpenPGP packet:'
echo ' Failed to parse Signature Packet'
echo ' because: Malformed packet: Subpacket extends beyond the end of the subpacket area)'
fi`
error: /tmp/hello-2.0-1.x86_64-signed.rpm cannot be installed
])
AT_CLEANUP

50
tests/rpmsigdig.at
View File

@ -386,17 +386,17 @@ AT_CHECK([
RPMDB_INIT
echo Checking package before importing key:
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
echo Importing key:
runroot rpmkeys --quiet --import /data/keys/alice-expired-subkey.asc; echo $?
runroot rpmkeys --quiet --import /data/keys/alice-expired-subkey.asc 2>&1; echo $?
echo Checking for key:
runroot rpm -qi gpg-pubkey-eb04e625-* | grep Version | head -n1
echo Checking package after importing key:
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
echo Checking package after importing key, no digest:
runroot rpmkeys --define '_pkgverify_level all' -Kv --nodigest /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv --nodigest /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
echo Checking package after importing key, no signature:
runroot rpmkeys --define '_pkgverify_level all' -Kv --nosignature /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv --nosignature /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
],
[0],
[[Checking package before importing key:
@ -416,6 +416,10 @@ Checking for key:
Version : eb04e625
Checking package after importing key:
/data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm:
error: Verifying a signature using certificate B6542F92F30650C36B6F41BCB3A771BFEB04E625 (Alice <alice@example.org>):
Key 1F71177215217EE0 invalid: key is not alive
because: The subkey is not live
because: Expired on 2022-04-12T00:00:15Z
Header V4 RSA/SHA512 Signature, key ID 15217ee0: NOTTRUSTED
Header DSA signature: NOTFOUND
Header SHA256 digest: OK
@ -427,6 +431,10 @@ Checking package after importing key:
1
Checking package after importing key, no digest:
/data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm:
error: Verifying a signature using certificate B6542F92F30650C36B6F41BCB3A771BFEB04E625 (Alice <alice@example.org>):
Key 1F71177215217EE0 invalid: key is not alive
because: The subkey is not live
because: Expired on 2022-04-12T00:00:15Z
Header V4 RSA/SHA512 Signature, key ID 15217ee0: NOTTRUSTED
Header DSA signature: NOTFOUND
RSA signature: NOTFOUND
@ -455,15 +463,15 @@ RPMDB_INIT
echo Checking package before importing key:
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
echo Importing key:
runroot rpmkeys --quiet --import /data/keys/alice-revoked-subkey.asc; echo $?
runroot rpmkeys --quiet --import /data/keys/alice-revoked-subkey.asc 2>&1; echo $?
echo Checking for key:
runroot rpm -qi gpg-pubkey-eb04e625-* | grep Version | head -n1
echo Checking package after importing key:
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
echo Checking package after importing key, no digest:
runroot rpmkeys --define '_pkgverify_level all' -Kv --nodigest /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv --nodigest /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
echo Checking package after importing key, no signature:
runroot rpmkeys --define '_pkgverify_level all' -Kv --nosignature /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm; echo $?
runroot rpmkeys --define '_pkgverify_level all' -Kv --nosignature /data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm 2>&1; echo $?
],
[0],
[[Checking package before importing key:
@ -483,6 +491,8 @@ Checking for key:
Version : eb04e625
Checking package after importing key:
/data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm:
error: Verifying a signature using certificate B6542F92F30650C36B6F41BCB3A771BFEB04E625 (Alice <alice@example.org>):
Key 1F71177215217EE0 is invalid: key is revoked
Header V4 RSA/SHA512 Signature, key ID 15217ee0: NOTTRUSTED
Header DSA signature: NOTFOUND
Header SHA256 digest: OK
@ -494,6 +504,8 @@ Checking package after importing key:
1
Checking package after importing key, no digest:
/data/RPMS/hello-2.0-1.x86_64-signed-with-subkey.rpm:
error: Verifying a signature using certificate B6542F92F30650C36B6F41BCB3A771BFEB04E625 (Alice <alice@example.org>):
Key 1F71177215217EE0 is invalid: key is revoked
Header V4 RSA/SHA512 Signature, key ID 15217ee0: NOTTRUSTED
Header DSA signature: NOTFOUND
RSA signature: NOTFOUND
@ -740,7 +752,7 @@ AT_CLEANUP
# Test pre-built corrupted package verification (corrupted signature)
AT_SETUP([rpmkeys -Kv <corrupted signed> 1])
AT_KEYWORDS([rpmkeys digest signature])
AT_CHECK([
AT_CHECK_UNQUOTED([
RPMDB_INIT
pkg="hello-2.0-1.x86_64-signed.rpm"
@ -754,14 +766,28 @@ runroot rpmkeys -Kv /tmp/${pkg}
],
[1],
[/tmp/hello-2.0-1.x86_64-signed.rpm:
Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)
`if test x$PGP = xinternal; then
echo ' Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)'
else
echo ' Header RSA signature: BAD (package tag 268: invalid OpenPGP signature: Parsing an OpenPGP packet:'
echo ' Failed to parse Signature Packet'
echo ' because: Signature appears to be created by a non-conformant OpenPGP implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>.'
echo ' because: Malformed MPI: leading bit is not set: expected bit 1 to be set in 0 (0))'
fi`
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK
V4 RSA/SHA256 Signature, key ID 1964c5fc: NOKEY
MD5 digest: OK
/tmp/hello-2.0-1.x86_64-signed.rpm:
Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)
`if test x$PGP = xinternal; then
echo ' Header RSA signature: BAD (package tag 268: invalid OpenPGP signature)'
else
echo ' Header RSA signature: BAD (package tag 268: invalid OpenPGP signature: Parsing an OpenPGP packet:'
echo ' Failed to parse Signature Packet'
echo ' because: Signature appears to be created by a non-conformant OpenPGP implementation, see <https://github.com/rpm-software-management/rpm/issues/2351>.'
echo ' because: Malformed MPI: leading bit is not set: expected bit 1 to be set in 0 (0))'
fi`
Header SHA256 digest: OK
Header SHA1 digest: OK
Payload SHA256 digest: OK