# The gpg_verify macro is defined further down in this document.
# gpg_verify takes one option and a list of 2- or 3-tuples.
#
# With no arguments, attempts to figure everything out. Finds one keyring and
# tries to pair each signature file with a source. If there is no source found
# which matches a signature, the build is aborted.
#
# -k gives a common keyring to verify all signatures against, except when an
# argument specifies its own keyring.
#
# Each argument must be of the form "F,S,K" or "F,S", where each of F, S and K
# is either the number or the filename of one of the source files in the
# package. A pathname including directories is not allowed.
# F is a source file to check.
# S is a signature.
# K is a keyring.
#
# When an argument specifies a keyring, that signature will be verified against
# the keys in that keyring. For arguments that don't specify a keyring, the one
# specified with -k will be used, if any. If no keyring is specified either
# way, the macro will default to the first one it finds in the source list.
#
# It is assumed that all the keys in all keyrings, whether automatically found
# or explicitly specified, are trusted to authenticate the source files. There
# must not be any untrusted keys included.
# Some utility functions to the global namespace
# Most of these should come from the utility macros in the other repo.
%define gpg_macros_init %{lua:
function db(str)
io.stderr:write(tostring(str) .. '\\n')
end
\
-- Simple basename clone
function basename(str)
local name = string.gsub(str, "(.*/)(.*)", "%2")
return name
end
\
-- Get the numbered or source file.
-- The spec writer can use any numbering scheme. The sources table
-- always counts from 1 and has no gaps, so we have to go back to the
-- SOURCEN macros.
function get_numbered_source(num)
local macro = "%SOURCE" .. num
local val = rpm.expand(macro)
if val == macro then
return nil
end
return val
end
-- Get the named source file. This returns the full path to a source file,
-- or nil if no such source exists.
function get_named_source(name)
local path
for _,path in ipairs(sources) do
if name == basename(path) then
return path
end
end
return nil
end
\
-- Determine whether the supplied filename contains a signature
-- Assumes the file will be closed when the handle goes out of scope
function is_signature(fname)
-- I don't really like this, but you can have completely binary sigs
if string.find(fname, '%.sig$') then
return true
end
local file = io.open(fname, 'r')
if file == nil then return false end
\
local c = 1
while true do
local line = file:read('*line')
if (line == nil or c > 10) then break end
if string.find(line, "BEGIN PGP SIGNATURE") then
return true
end
c = c+1
end
return false
end
\
-- Determine whether the supplied filename looks like a keyring
-- Ends in .gpg (might be binary data)? Contains "BEGIN PGP PUBLIC KEY BLOCK"
function is_keyring(fname)
-- XXX Have to hack this now to make it not find macros.gpg while we're testing.
if string.find(fname, '%.gpg$') and not string.find(fname, 'macros.gpg$') then
return true
end
\
local file = io.open(fname, 'r')
if file == nil then return false end
io.input(file)
local c = 1
while true do
local line = io.read('*line')
if (line == nil or c > 10) then break end
if string.find(line, "BEGIN PGP PUBLIC KEY BLOCK") then
return true
end
c = c+1
end
return false
end
\
-- Output code to have the current scriptlet echo something
function echo(str)
print("echo " .. str .. "\\n")
end
\
-- Output an exit statement with nonzero return to the current scriptlet
function exit()
print("exit 1\\n")
end
\
-- Call the RPM %error macro
function rpmerror(str)
echo("gpg_verify: " .. str)
rpm.expand("%{error:gpg_verify: " .. str .. "}")
exit(1)
end
\
-- XXX How to we get just a flag and no option?
function getflag(flag)
return nil
end
\
-- Extract the value of a passed option
function getoption(opt)
out = rpm.expand("%{-" .. opt .. "*}")
-- if string.len(out) == 0 then
if #out == 0 then
return nil
end
return out
end
\
function unknownarg(a)
rpmerror("Unknown argument to %%gpg_verify: " .. a)
end
\
function rprint(s, l, i) -- recursive Print (structure, limit, indent)
l = (l) or 100; i = i or ""; -- default item limit, indent string
if (l<1) then db("ERROR: Item limit reached."); return l-1 end;
local ts = type(s);
if (ts ~= "table") then db(i,ts,s); return l-1 end
db(i,ts); -- print "table"
for k,v in pairs(s) do -- db("[KEY] VALUE")
l = rprint(v, l, i.."\t["..tostring(k).."]");
if (l < 0) then break end
end
return l
end
\
-- Given a list of source file numbers or file names, validate them and
-- convert them to a list of full filenames.
function check_sources_list(arr)
local files = {}
local src,fpath
for _, src in ipairs(arr) do
if tonumber(src) then
-- We have a number; turn it to a full path to the corresponding source file
fpath = get_numbered_source(src)
else
fpath = get_named_source(src)
end
if not src then
err = 'Not a valid source: ' .. src
if src == '1' then
err = err .. '. Note that "Source:" is the 0th source file, not the 1st.'
end
rpmerror(err)
end
table.insert(files, fpath)
end
return files
end
rpm.define("gpg_macros_init %{nil}")
}#
# The actual macro
%define gpg_verify(k:) %gpg_macros_init%{lua:
-- RPM will ignore the first thing we output unless we give it a newline.
print('\\n')
\
local defkeyspec = getoption("k")
local args = rpm.expand("%*")
local sourcefiles = {}
local signature_table = {}
local signatures = {}
local keyrings = {}
local defkey, match, captures, s
\
local function storematch(m, c)
match = m; captures = c
end
\
-- Scan all of the sources and try to categorize them.
-- Move to a function
for i,s in pairs(sources) do
sourcefiles[s] = true
-- db('File: ' .. i .. ", " .. s)
if is_signature(s) then
table.insert(signatures, s)
signature_table[s] = true
db('Found signature: ' .. s)
elseif is_keyring(s) then
table.insert(keyrings, s)
db('Found keyring: ' .. s)
else
-- Must be a source
db('Found source: ' .. s)
end
end
\
if defkeyspec then
defkey = check_sources_list({defkeyspec})[1]
if not defkey then
rpmerror('The provided keyring ' .. defkeyspec .. ' is not a valid source number or filename.')
end
end
\
if defkey then
db('Defkey: ' .. defkey)
else
db('No common key yet')
if keyrings[1] then
defkey = keyrings[1]
db('Using first found keyring file: '..defkey)
end
end
\
-- Check over any given args to make sure they're valid, and to see if a
-- common key is required.
local needdefkey = false
local double = rex.newPOSIX('^([^,]+),([^,]+)$')
local triple = rex.newPOSIX('^([^,]+),([^,]+),([^,]+)$')
local arglist = {}
\
-- RPM gives us the arguments in a single string.
-- Split on spaces and iterate
for arg in args:gmatch('%S+') do
db('Checking ' .. arg)
if triple:gmatch(arg, storematch) > 0 then
db('Looks OK')
local parsed = {srcnum=captures[1], signum=captures[2], keynum=captures[3]}
s = check_sources_list({captures[1], captures[2], captures[3]})
parsed.srcfile = s[1]
parsed.sigfile = s[2]
parsed.keyfile = s[3]
table.insert(arglist, parsed)
elseif double:gmatch(arg, storematch) > 0 then
db('Looks OK; needs common key')
needdefkey = true
local parsed = {srcnum=captures[1], signum=captures[2], keynum=defkeyspec, keyfile=defkey}
s = check_sources_list({captures[1], captures[2]})
parsed.srcfile = s[1]
parsed.sigfile = s[2]
table.insert(arglist, parsed)
else
rpmerror('Provided argument '..arg..' is not valid.')
end
end
\
-- So we now know if one of those args needs a common key
if needdefkey and not defkey then
rpmerror('No common key was specified or found, yet the arguments require one.')
end
\
-- And if we have no arguments at all and no common key was found,
-- then we can't do an automatic check
if not defkey and args == '' then
rpmerror('No keyring specified and none found; cannot auto-check.')
end
\
-- Nothing to check means automatic mode
if #arglist == 0 then
local noext
for i,_ in pairs(signature_table) do
-- Find the name without the extension
noext = string.gsub(i, '%.[^.]+$', '')
if sourcefiles[noext] then
table.insert(arglist, {srcfile=noext, sigfile=i, keyfile=defkey})
else
rpmerror('Found signature ' .. i .. ' with no matching source file.')
end
end
end
\
-- Now actually check things
for _,arg in ipairs(arglist) do
local gpgfile = '$GPGHOME/' .. basename(arg.keyfile) .. '.gpg'
echo('Checking signature: file ' .. arg.srcfile .. ' sig ' .. arg.sigfile .. ' key ' .. arg.keyfile)
\
-- We need a secure temp directorry
print('GPGHOME=$(mktemp -qd)\\n')
\
-- Call gpg2 to generate the dearmored key
print('gpg2 --homedir $GPGHOME --no-default-keyring --quiet --yes ')
print('--output '.. gpgfile .. ' --dearmor ' .. arg.keyfile .. "\\n")
\
-- Call gpgv2 to verify the signature against the source file with the dearmored key
print('gpgv2 --homedir $GPGHOME --keyring ' .. gpgfile .. ' ' .. arg.sigfile .. ' ' .. arg.srcfile .. '\\n')
\
print('rm -rf $GPGHOME\\n')
echo('')
end
\
db('------------')
}#
# vim: set filetype=spec: