Re: [gentoo-dev] [PATCH] verify-sig.eclass: add app-crypt/signify support

[Haelwenn (lanodan) Monnier]

Nice patch, got few things that I think should be changed though:

[2021-12-08 07:54:04+0500] Anna Vyalkova:
>+case ${VERIFY_SIG_IMPL} in
>+	gnupg)
>+		BDEPEND="
>+			verify-sig? (
>+				app-crypt/gnupg
>+				>=app-portage/gemato-16
>+			)"
>+		;;
>+	signify)
>+		BDEPEND="verify-sig? ( app-crypt/signify )"

Might be worth it to depend on app-crypt/minisign instead or depend on any.
minisign is already stabilized and I slightly prefer it's implementation over 
the ported signify as there is no vendoring.
That said minisign could be considered bloated compared to signify.


> verify-sig_verify_detached() {
> 	local file=${1}
> 	local sig=${2}
> 	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
>
> 	[[ -n ${key} ]] ||
> 		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
>
> 	local extra_args=()
> 	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
>-	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
>-		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
>-	)
>+	if [[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]]; then
>+		[[ ${VERIFY_SIG_IMPL} == gnupg ]] ||
>+			die "${FUNCNAME}: VERIFY_SIG_OPENPGP_KEYSERVER is not supported"
>+
>+		extra_args+=(
>+			--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
>+		)
>+	fi
>
> 	# GPG upstream knows better than to follow the spec, so we can't
> 	# override this directory.  However, there is a clean fallback
> 	# to GNUPGHOME.
> 	addpredict /run/user
>
> 	local filename=${file##*/}
> 	[[ ${file} == - ]] && filename='(stdin)'
> 	einfo "Verifying ${filename} ..."
>-	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
>-		gpg --verify "${sig}" "${file}" ||
>-		die "PGP signature verification failed"
>+	case ${VERIFY_SIG_IMPL} in
>+		gnupg)
>+			gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
>+				gpg --verify "${sig}" "${file}" ||
>+				die "PGP signature verification failed"
>+			;;
>+		signify)
>+			signify -V -p "${key}" -m "${file}" -x "${sig}" ||
>+				die "PGP signature verification failed"

Should be something like "Signify signature verification failed".

>+			;;
>+	esac
> }
>
> # @FUNCTION: verify-sig_verify_message
> # @USAGE: <file> <output-file> [<key-file>]
> # @DESCRIPTION:
> # Verify that the file ('-' for stdin) contains a valid, signed PGP
> # message and write the message into <output-file> ('-' for stdout).
> # <key-file> can either be passed directly, or it defaults
> # to VERIFY_SIG_OPENPGP_KEY_PATH.  The function dies if verification
> # fails.  Note that using output from <output-file> is important as it
> # prevents the injection of unsigned data.
> verify-sig_verify_message() {
> 	local file=${1}
> 	local output_file=${2}
> 	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
>
> 	[[ -n ${key} ]] ||
> 		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
>
> 	local extra_args=()
> 	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
>-	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
>-		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
>-	)
>+	if [[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]]; then
>+		[[ ${VERIFY_SIG_IMPL} == gnupg ]] ||
>+			die "${FUNCNAME}: VERIFY_SIG_OPENPGP_KEYSERVER is not supported"
>+
>+		extra_args+=(
>+			--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
>+		)
>+	fi
>
> 	# GPG upstream knows better than to follow the spec, so we can't
> 	# override this directory.  However, there is a clean fallback
> 	# to GNUPGHOME.
> 	addpredict /run/user
>
> 	local filename=${file##*/}
> 	[[ ${file} == - ]] && filename='(stdin)'
> 	einfo "Verifying ${filename} ..."
>-	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
>-		gpg --verify --output="${output_file}" "${file}" ||
>-		die "PGP signature verification failed"
>+	case ${VERIFY_SIG_IMPL} in
>+		gnupg)
>+			gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
>+				gpg --verify --output="${output_file}" "${file}" ||
>+				die "PGP signature verification failed"
>+			;;
>+		signify)
>+			signify -V -e -p "${key}" -m "${output_file}" -x "${file}" ||
>+				die "PGP signature verification failed"

Should be something like "Signify signature verification failed".

>+# @FUNCTION: verify-sig_verify_signed_checksums
>+# @USAGE: <checksum-file> <algo> <files> [<key-file>]
>+# @DESCRIPTION:
>+# Verify the checksums for all files listed in the space-separated list
>+# <files> (akin to ${A}) using a PGP-signed <checksum-file>.  <algo>
>+# specified the checksum algorithm (e.g. sha256).  <key-file> can either
>+# be passed directly, or it defaults to VERIFY_SIG_OPENPGP_KEY_PATH.
>+#
>+# The function dies if PGP verification fails, the checksum file
>+# contains unsigned data, one of the files do not match checksums
>+# or are missing from the checksum file.
>+verify-sig_verify_signed_checksums() {
>+	local checksum_file=${1}
>+	local algo=${2}
>+	local files=()
>+	read -r -d '' -a files <<<"${3}"
>+	local key=${4:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
>+
>+	[[ -n ${key} ]] ||
>+		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
>+
>+	case ${VERIFY_SIG_IMPL} in
>+		gnupg)
>+			_gpg_verify_signed_checksums \
>+				"${checksum_file}" "${algo}" "${files[@]}" "${key}"
>+			;;
>+		signify)
>+			signify -C -p "${key}" \
>+				-x "${checksum_file}" "${files[@]}" ||
>+				die "PGP signature verification failed"

Should be something like "Signify signature verification failed".