summaryrefslogtreecommitdiff
path: root/apt-pkg/acquire-item.cc
diff options
context:
space:
mode:
authorJulian Andres Klode <jak@debian.org>2019-01-22 15:02:36 +0000
committerJulian Andres Klode <jak@debian.org>2019-01-22 15:02:36 +0000
commit690bc2923814b3620ace1ffcb710603f81fa217f (patch)
tree8380002362e00afea87f1157e89505c0e6e8371f /apt-pkg/acquire-item.cc
parent5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b (diff)
parent7bf533967fb385b9625a1ee4dd7c6542a84b489c (diff)
Merge branch 'pu/gpgvsignedby' into 'master'
Report keys used to sign file from gpgv method to acquire system See merge request apt-team/apt!44
Diffstat (limited to 'apt-pkg/acquire-item.cc')
-rw-r--r--apt-pkg/acquire-item.cc18
1 files changed, 15 insertions, 3 deletions
diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 83c793093..755e1fb59 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1464,8 +1464,20 @@ bool pkgAcqMetaBase::CheckDownloadDone(pkgAcqTransactionItem * const I, const st
return true;
}
/*}}}*/
-bool pkgAcqMetaBase::CheckAuthDone(string const &Message) /*{{{*/
+bool pkgAcqMetaBase::CheckAuthDone(string const &Message, pkgAcquire::MethodConfig const *const Cnf) /*{{{*/
{
+ /* If we work with a recent version of our gpgv method, we expect that it tells us
+ which key(s) have signed the file so stuff like CVE-2018-0501 is harder in the future */
+ if (Cnf->Version != "1.0" && LookupTag(Message, "Signed-By").empty())
+ {
+ std::string errmsg;
+ strprintf(errmsg, "Internal Error: Signature on %s seems good, but expected details are missing! (%s)", Target.URI.c_str(), "Signed-By");
+ if (ErrorText.empty())
+ ErrorText = errmsg;
+ Status = StatAuthError;
+ return _error->Error("%s", errmsg.c_str());
+ }
+
// At this point, the gpgv method has succeeded, so there is a
// valid signature from a key in the trusted keyring. We
// perform additional verification of its contents, and use them
@@ -1946,7 +1958,7 @@ void pkgAcqMetaClearSig::Done(std::string const &Message,
QueueForSignatureVerify(this, DestFile, DestFile);
return;
}
- else if(CheckAuthDone(Message) == true)
+ else if (CheckAuthDone(Message, Cnf) == true)
{
if (TransactionManager->IMSHit == false)
TransactionManager->TransactionStageCopy(this, DestFile, GetFinalFilename());
@@ -2190,7 +2202,7 @@ void pkgAcqMetaSig::Done(string const &Message, HashStringList const &Hashes,
}
return;
}
- else if(MetaIndex->CheckAuthDone(Message) == true)
+ else if (MetaIndex->CheckAuthDone(Message, Cfg) == true)
{
auto const Releasegpg = GetFinalFilename();
auto const Release = MetaIndex->GetFinalFilename();