[gentoo-dev] [PATCH] verify-sig.eclass: Enable EAPI 8 support

[Michał Górny]

No changes beside EAPI guards, full eclass included for review
convenience.

Signed-off-by: Michał Górny <mgorny@g.o>
---
 eclass/verify-sig.eclass | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/eclass/verify-sig.eclass b/eclass/verify-sig.eclass
index e3ef7f240283..7f89e5388ba3 100644
--- a/eclass/verify-sig.eclass
+++ b/eclass/verify-sig.eclass
@@ -1,271 +1,265 @@
-# Copyright 2020 Gentoo Authors
+# Copyright 2020-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: verify-sig.eclass
 # @MAINTAINER:
 # Michał Górny <mgorny@g.o>
-# @SUPPORTED_EAPIS: 7
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: Eclass to verify upstream signatures on distfiles
 # @DESCRIPTION:
 # verify-sig eclass provides a streamlined approach to verifying
 # upstream signatures on distfiles.  Its primary purpose is to permit
 # developers to easily verify signatures while bumping packages.
 # The eclass removes the risk of developer forgetting to perform
 # the verification, or performing it incorrectly, e.g. due to additional
 # keys in the local keyring.  It also permits users to verify
 # the developer's work.
 #
 # To use the eclass, start by packaging the upstream's key
 # as app-crypt/openpgp-keys-*.  Then inherit the eclass, add detached
 # signatures to SRC_URI and set VERIFY_SIG_OPENPGP_KEY_PATH.  The eclass
 # provides verify-sig USE flag to toggle the verification.
 #
 # Example use:
 # @CODE
 # inherit verify-sig
 #
 # SRC_URI="https://example.org/${P}.tar.gz
 #   verify-sig? ( https://example.org/${P}.tar.gz.sig )"
 # BDEPEND="
 #   verify-sig? ( app-crypt/openpgp-keys-example )"
 #
 # VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/example.asc
 # @CODE
 
-case "${EAPI:-0}" in
-	0|1|2|3|4|5|6)
-		die "Unsupported EAPI=${EAPI} (obsolete) for ${ECLASS}"
-		;;
-	7)
-		;;
-	*)
-		die "Unsupported EAPI=${EAPI} (unknown) for ${ECLASS}"
-		;;
+case ${EAPI} in
+	7|8) ;;
+	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
 
 EXPORT_FUNCTIONS src_unpack
 
 if [[ ! ${_VERIFY_SIG_ECLASS} ]]; then
 
 IUSE="verify-sig"
 
 BDEPEND="
 	verify-sig? (
 		app-crypt/gnupg
 		>=app-portage/gemato-16
 	)"
 
 # @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEY_PATH
 # @DEFAULT_UNSET
 # @DESCRIPTION:
 # Path to key bundle used to perform the verification.  This is required
 # when using default src_unpack.  Alternatively, the key path can be
 # passed directly to the verification functions.
 
 # @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEYSERVER
 # @DEFAULT_UNSET
 # @DESCRIPTION:
 # Keyserver used to refresh keys.  If not specified, the keyserver
 # preference from the key will be respected.  If no preference
 # is specified by the key, the GnuPG default will be used.
 
 # @ECLASS-VARIABLE: VERIFY_SIG_OPENPGP_KEY_REFRESH
 # @USER_VARIABLE
 # @DESCRIPTION:
 # Attempt to refresh keys via WKD/keyserver.  Set it to "yes"
 # in make.conf to enable.  Note that this requires working Internet
 # connection.
 : ${VERIFY_SIG_OPENPGP_KEY_REFRESH:=no}
 
 # @FUNCTION: verify-sig_verify_detached
 # @USAGE: <file> <sig-file> [<key-file>]
 # @DESCRIPTION:
 # Read the detached signature from <sig-file> and verify <file> against
 # it.  <key-file> can either be passed directly, or it defaults
 # to VERIFY_SIG_OPENPGP_KEY_PATH.  The function dies if verification
 # fails.
 verify-sig_verify_detached() {
 	local file=${1}
 	local sig=${2}
 	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
 
 	[[ -n ${key} ]] ||
 		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
 
 	local extra_args=()
 	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
 	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
 		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
 	)
 
 	# GPG upstream knows better than to follow the spec, so we can't
 	# override this directory.  However, there is a clean fallback
 	# to GNUPGHOME.
 	addpredict /run/user
 
 	local filename=${file##*/}
 	[[ ${file} == - ]] && filename='(stdin)'
 	einfo "Verifying ${filename} ..."
 	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
 		gpg --verify "${sig}" "${file}" ||
 		die "PGP signature verification failed"
 }
 
 # @FUNCTION: verify-sig_verify_message
 # @USAGE: <file> <output-file> [<key-file>]
 # @DESCRIPTION:
 # Verify that the file ('-' for stdin) contains a valid, signed PGP
 # message and write the message into <output-file> ('-' for stdout).
 # <key-file> can either be passed directly, or it defaults
 # to VERIFY_SIG_OPENPGP_KEY_PATH.  The function dies if verification
 # fails.  Note that using output from <output-file> is important as it
 # prevents the injection of unsigned data.
 verify-sig_verify_message() {
 	local file=${1}
 	local output_file=${2}
 	local key=${3:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
 
 	[[ -n ${key} ]] ||
 		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
 
 	local extra_args=()
 	[[ ${VERIFY_SIG_OPENPGP_KEY_REFRESH} == yes ]] || extra_args+=( -R )
 	[[ -n ${VERIFY_SIG_OPENPGP_KEYSERVER+1} ]] && extra_args+=(
 		--keyserver "${VERIFY_SIG_OPENPGP_KEYSERVER}"
 	)
 
 	# GPG upstream knows better than to follow the spec, so we can't
 	# override this directory.  However, there is a clean fallback
 	# to GNUPGHOME.
 	addpredict /run/user
 
 	local filename=${file##*/}
 	[[ ${file} == - ]] && filename='(stdin)'
 	einfo "Verifying ${filename} ..."
 	gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
 		gpg --verify --output="${output_file}" "${file}" ||
 		die "PGP signature verification failed"
 }
 
 # @FUNCTION: verify-sig_verify_signed_checksums
 # @USAGE: <checksum-file> <algo> <files> [<key-file>]
 # @DESCRIPTION:
 # Verify the checksums for all files listed in the space-separated list
 # <files> (akin to ${A}) using a PGP-signed <checksum-file>.  <algo>
 # specified the checksum algorithm (e.g. sha256).  <key-file> can either
 # be passed directly, or it defaults to VERIFY_SIG_OPENPGP_KEY_PATH.
 #
 # The function dies if PGP verification fails, the checksum file
 # contains unsigned data, one of the files do not match checksums
 # or are missing from the checksum file.
 verify-sig_verify_signed_checksums() {
 	local checksum_file=${1}
 	local algo=${2}
 	local files=()
 	read -r -d '' -a files <<<"${3}"
 	local key=${4:-${VERIFY_SIG_OPENPGP_KEY_PATH}}
 
 	local chksum_prog chksum_len
 	case ${algo} in
 		sha256)
 			chksum_prog=sha256sum
 			chksum_len=64
 			;;
 		*)
 			die "${FUNCNAME}: unknown checksum algo ${algo}"
 			;;
 	esac
 
 	[[ -n ${key} ]] ||
 		die "${FUNCNAME}: no key passed and VERIFY_SIG_OPENPGP_KEY_PATH unset"
 
 	local checksum filename junk ret=0 count=0
 	while read -r checksum filename junk; do
 		[[ ${#checksum} -eq ${chksum_len} ]] || continue
 		[[ -z ${checksum//[0-9a-f]} ]] || continue
 		has "${filename}" "${files[@]}" || continue
 		[[ -z ${junk} ]] || continue
 
 		"${chksum_prog}" -c --strict - <<<"${checksum} ${filename}"
 		if [[ ${?} -eq 0 ]]; then
 			(( count++ ))
 		else
 			ret=1
 		fi
 	done < <(verify-sig_verify_message "${checksum_file}" - "${key}")
 
 	[[ ${ret} -eq 0 ]] ||
 		die "${FUNCNAME}: at least one file did not verify successfully"
 	[[ ${count} -eq ${#files[@]} ]] ||
 		die "${FUNCNAME}: checksums for some of the specified files were missing"
 }
 
 # @FUNCTION: verify-sig_src_unpack
 # @DESCRIPTION:
 # Default src_unpack override that verifies signatures for all
 # distfiles if 'verify-sig' flag is enabled.  The function dies if any
 # of the signatures fails to verify or if any distfiles are not signed.
 # Please write src_unpack() yourself if you need to perform partial
 # verification.
 verify-sig_src_unpack() {
 	if use verify-sig; then
 		local f suffix found
 		local distfiles=() signatures=() nosigfound=() straysigs=()
 
 		# find all distfiles and signatures, and combine them
 		for f in ${A}; do
 			found=
 			for suffix in .asc .sig; do
 				if [[ ${f} == *${suffix} ]]; then
 					signatures+=( "${f}" )
 					found=sig
 					break
 				else
 					if has "${f}${suffix}" ${A}; then
 						distfiles+=( "${f}" )
 						found=dist+sig
 						break
 					fi
 				fi
 			done
 			if [[ ! ${found} ]]; then
 				nosigfound+=( "${f}" )
 			fi
 		done
 
 		# check if all distfiles are signed
 		if [[ ${#nosigfound[@]} -gt 0 ]]; then
 			eerror "The following distfiles lack detached signatures:"
 			for f in "${nosigfound[@]}"; do
 				eerror "  ${f}"
 			done
 			die "Unsigned distfiles found"
 		fi
 
 		# check if there are no stray signatures
 		for f in "${signatures[@]}"; do
 			if ! has "${f%.*}" "${distfiles[@]}"; then
 				straysigs+=( "${f}" )
 			fi
 		done
 		if [[ ${#straysigs[@]} -gt 0 ]]; then
 			eerror "The following signatures do not match any distfiles:"
 			for f in "${straysigs[@]}"; do
 				eerror "  ${f}"
 			done
 			die "Unused signatures found"
 		fi
 
 		# now perform the verification
 		for f in "${signatures[@]}"; do
 			verify-sig_verify_detached \
 				"${DISTDIR}/${f%.*}" "${DISTDIR}/${f}"
 		done
 	fi
 
 	# finally, unpack the distfiles
 	default_src_unpack
 }
 
 _VERIFY_SIG_ECLASS=1
 fi
-- 
2.32.0