Gentoo Archives: gentoo-portage-dev

From: "Michał Górny" <mgorny@g.o>
To: gentoo-portage-dev@l.g.o
Cc: "Michał Górny" <mgorny@g.o>
Subject: [gentoo-portage-dev] [PATCH 1/2] sync: Split key refresh into explicit WKD/keyserver phases
Date: Fri, 05 Jul 2019 05:19:34
Message-Id: 20190705051925.5070-1-mgorny@gentoo.org
1 Split key refresh into two parts: first try to refresh the key via WKD,
2 then via keyservers, rather than using the combined function that is
3 less explicit. This ensures that users are correctly informed whether
4 keyservers are actually used, and therefore whether they may be subject
5 to SKS poisoning attacks. Furthermore, it skips WKD from retry loop.
6
7 Signed-off-by: Michał Górny <mgorny@g.o>
8 ---
9 lib/portage/sync/syncbase.py | 10 ++++++++--
10 1 file changed, 8 insertions(+), 2 deletions(-)
11
12 diff --git a/lib/portage/sync/syncbase.py b/lib/portage/sync/syncbase.py
13 index d15bb6d14..46644d68e 100644
14 --- a/lib/portage/sync/syncbase.py
15 +++ b/lib/portage/sync/syncbase.py
16 @@ -252,11 +252,17 @@ class SyncBase(object):
17 @type openpgp_env: gemato.openpgp.OpenPGPEnvironment
18 """
19 out = portage.output.EOutput(quiet=('--quiet' in self.options['emerge_config'].opts))
20 + out.ebegin('Refreshing keys via WKD')
21 + if openpgp_env.refresh_keys_wkd():
22 + out.eend(0)
23 + return
24 + out.eend(1)
25 +
26 out.ebegin('Refreshing keys from keyserver{}'.format(
27 ('' if self.repo.sync_openpgp_keyserver is None else ' ' + self.repo.sync_openpgp_keyserver)))
28 retry_decorator = self._key_refresh_retry_decorator()
29 if retry_decorator is None:
30 - openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver)
31 + openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver)
32 else:
33 def noisy_refresh_keys():
34 """
35 @@ -264,7 +270,7 @@ class SyncBase(object):
36 errors, display errors as soon as they occur.
37 """
38 try:
39 - openpgp_env.refresh_keys(keyserver=self.repo.sync_openpgp_keyserver)
40 + openpgp_env.refresh_keys_keyserver(keyserver=self.repo.sync_openpgp_keyserver)
41 except Exception as e:
42 writemsg_level("%s\n" % (e,),
43 level=logging.ERROR, noiselevel=-1)
44 --
45 2.22.0

Replies