1 |
Split key refresh into two parts: first try to refresh the key via WKD, |
2 |
then via keyservers, rather than using the combined function that is |
3 |
less explicit. This ensures that users are correctly informed whether |
4 |
keyservers are actually used, and therefore whether they may be subject |
5 |
to SKS poisoning attacks. Furthermore, it skips WKD from retry loop. |
6 |
|
7 |
Signed-off-by: Michał Górny <mgorny@g.o> |
8 |
--- |
9 |
lib/portage/sync/syncbase.py | 10 ++++++++-- |
10 |
1 file changed, 8 insertions(+), 2 deletions(-) |
11 |
|
12 |
diff --git a/lib/portage/sync/syncbase.py b/lib/portage/sync/syncbase.py |
13 |
index d15bb6d14..46644d68e 100644 |
14 |
--- a/lib/portage/sync/syncbase.py |
15 |
+++ b/lib/portage/sync/syncbase.py |
16 |
@@ -252,11 +252,17 @@ class SyncBase(object): |
17 |
@type openpgp_env: gemato.openpgp.OpenPGPEnvironment |
18 |
""" |
19 |
out = portage.output.EOutput(quiet=('--quiet' in self.options['emerge_config'].opts)) |
20 |
+ out.ebegin('Refreshing keys via WKD') |
21 |
+ if openpgp_env.refresh_keys_wkd(): |
22 |
+ out.eend(0) |
23 |
+ return |
24 |
+ out.eend(1) |
25 |
+ |
26 |
out.ebegin('Refreshing keys from keyserver{}'.format( |
27 |
('' if self.repo.sync_openpgp_keyserver is None else ' ' + self.repo.sync_openpgp_keyserver))) |
28 |
retry_decorator = self._key_refresh_retry_decorator() |
29 |
if retry_decorator is None: |
30 |
- openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver) |
31 |
+ openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver) |
32 |
else: |
33 |
def noisy_refresh_keys(): |
34 |
""" |
35 |
@@ -264,7 +270,7 @@ class SyncBase(object): |
36 |
errors, display errors as soon as they occur. |
37 |
""" |
38 |
try: |
39 |
- openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver) |
40 |
+ openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver) |
41 |
except Exception as e: |
42 |
writemsg_level("%s\n" % (e,), |
43 |
level=logging.ERROR, noiselevel=-1) |
44 |
-- |
45 |
2.22.0 |