1 |
Add a function to verify files containing PGP signed messages (i.e. not |
2 |
using detached signatures). This will be used for projects that publish |
3 |
signed checksum lists. |
4 |
|
5 |
Signed-off-by: Michał Górny <mgorny@g.o> |
6 |
--- |
7 |
eclass/verify-sig.eclass | 36 ++++++++++++++++++++++++++++++++++++ |
8 |
1 file changed, 36 insertions(+) |
9 |
|
10 |
Changed in v2: actually, 'gemato openpgp-verify' does not fail |
11 |
on unsigned data, Manifest loading algorithm checks for that. Use 'gpg |
12 |
--output' instead. |
13 |
|
14 |
diff --git a/eclass/verify-sig.eclass b/eclass/verify-sig.eclass |
15 |
index d16181f3bf0a..a499dd3c6c2a 100644 |
16 |
--- a/eclass/verify-sig.eclass |
17 |
+++ b/eclass/verify-sig.eclass |
18 |
@@ -111,6 +111,42 @@ verify-sig_verify_detached() { |
19 |
die "PGP signature verification failed" |
20 |
} |
21 |
|
22 |
+# @FUNCTION: verify-sig_verify_message |
23 |
+# @USAGE: <file> <output-file> [<key-file>] |
24 |
+# @DESCRIPTION: |
25 |
+# Verify that the file ('-' for stdin) contains a valid, signed PGP |
26 |
+# message and write the message into <output-file> ('-' for stdout). |
27 |
+# <key-file> can either be passed directly, or it defaults |
28 |
+# to VERIFY_SIG_OPENPGP_KEY_PATH. The function dies if verification |
29 |
+# fails. Note that using output from <output-file> is important as it |
30 |
+# prevents the injection of unsigned data. |
31 |
+verify-sig_verify_message() { |
32 |
+ local file=${1} |
33 |
+ local output_file=${2} |
34 |
+ local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}} |
35 |
+ |
36 |
+ [[ -n ${key} ]] || |
37 |
+ die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset" |
38 |
+ |
39 |
+ local extra_args=() |
40 |
+ [[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R ) |
41 |
+ [[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=( |
42 |
+ --keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}" |
43 |
+ ) |
44 |
+ |
45 |
+ # GPG upstream knows better than to follow the spec, so we can't |
46 |
+ # override this directory. However, there is a clean fallback |
47 |
+ # to GNUPGHOME. |
48 |
+ addpredict /run/user |
49 |
+ |
50 |
+ local filename=${file##*/} |
51 |
+ [[ ${file} == - ]] && filename='(stdin)' |
52 |
+ einfo "Verifying ${filename} ..." |
53 |
+ gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \ |
54 |
+ gpg --verify --output="${output_file}" "${sig}" "${file}" || |
55 |
+ die "PGP signature verification failed" |
56 |
+} |
57 |
+ |
58 |
# @FUNCTION: verify-sig_src_unpack |
59 |
# @DESCRIPTION: |
60 |
# Default src_unpack override that verifies signatures for all |
61 |
-- |
62 |
2.29.2 |