jmq/Documentation
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

pkgmeek: refactor the signature creation routines

Browse Source
This commit is contained in:
John McQuah 2023-02-17 15:35:54 -05:00
parent 8836cc870a
commit 95c2d2a6d6
1 changed files with 61 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
scripts/pkgmeek
View File

@ -8,12 +8,12 @@
main() { main() {
######################## main routine ################################ ######################## main routine ################################
local pkg_dir src_dir work _local_ here url u f DIR TARGET pkg_utd local pkg_dir src_dir work _local_ here url u pkg_utd f DIR TARGET
local errDL=0; local errUZ=0; local errDL=0; local errUZ=0; local BSDTAR="/usr/bin/bsdtar --format=gnutar"
parse_options "$@" parse_options "$@"
# Exit early if refreshing an existing sha256 manifest was requested # Exit early if refreshing an existing sha256 manifest was requested
[ "$PKGMK_REFRESH_SIG" = "yes" ] && { refresh_signature; exit $?; } [ "$PKGMK_REFRESH_SIG" = "yes" ] && { make_signature refresh ; exit $?; }
# #
# Read the Pkgfile to determine what to do next. But first ensure that # Read the Pkgfile to determine what to do next. But first ensure that
# it came from a trusted source (FS#1851) # it came from a trusted source (FS#1851)
@ -101,21 +101,16 @@ check_pkg_mtime; pkg_utd=$?
if [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ]; then if [ "$PKGMK_UPDATE_FOOTPRINT" = "yes" ]; then
[ -f "$pkg_dir$package" ] || \ [ -f "$pkg_dir$package" ] || \
{ error "unable to update footprint. File '$package' not found."; { error "unable to update footprint. File '$package' not found.";
exit "$E_FOOTPRINT"; } cleanup_work; exit "$E_FOOTPRINT"; }
[ "$pkg_utd" = 1 ] || [ "$PKGMK_FORCE" = "yes" ] || \ [ "$pkg_utd" = 1 ] || [ "$PKGMK_FORCE" = "yes" ] || \
{ error "outdated package. Use '-f' to force the footprint update."; { error "outdated package. Use '-f' to force the footprint update.";
exit "$E_FOOTPRINT"; } cleanup_work; exit "$E_FOOTPRINT"; }
cat_footprint > "$PKGMK_ROOT/.footprint" && info "footprint created." \ cat_footprint > "$PKGMK_ROOT/.footprint" && { info "footprint created."; exit 0; } \
|| { error "Failed to write the footprint."; cleanup_work; exit "$E_DIRPERM"; } || { error "Failed to write the footprint."; cleanup_work; exit "$E_DIRPERM"; }
fi fi
# Updating signatures (option -us) requires only sources and footprint, not a built package. # Updating signatures (option -us) requires only sources and footprint, not a built package.
if [ "$PKGMK_UPDATE_SIG" = "yes" ]; then # As with -uf, exit after fulfilling the explicit request for a manifest.
cat_signature > "$PKGMK_ROOT/.signature" && info "Signature successfully created." \ [ "$PKGMK_UPDATE_SIG" = "yes" ] && { make_signature new; cleanup_work; exit $?; }
|| { info "Could not create signature."; cleanup_work; exit "$E_DIRPERM"; }
fi
# Exit after fulfilling any *explicit* requests for (signed) manifests
[[ "$PKGMK_UPDATE_FOOTPRINT $PKGMK_UPDATE_SIG" =~ yes ]] && { cleanup_work; exit 0; }
# All the sources should be here by now, let's verify that we can trust them. # All the sources should be here by now, let's verify that we can trust them.
readonly cs_fail_msg="Use '--ignore-signature' to override, if you have determined integrity by other means." readonly cs_fail_msg="Use '--ignore-signature' to override, if you have determined integrity by other means."
@ -178,8 +173,8 @@ if [ "$pkg_utd" = 0 ] || [ "$PKGMK_FORCE" = "yes" ]; then
done } < <(find pkg -type l -path "*/man/man*/*" -printf '%f!%h\n') done } < <(find pkg -type l -path "*/man/man*/*" -printf '%f!%h\n')
# Create the archive # Create the archive
[ $UID = 0 ] || fake_uid="--uid 0 --gid 0" [ $UID = 0 ] || BSDTAR+=" --uid 0 --gid 0"
if (cd pkg; bsdtar --format=gnutar $fake_uid -cf "$pkg_dir$package" *); then if (cd pkg; $BSDTAR -cf "$pkg_dir$package" -- *); then
info "Package creation successful." info "Package creation successful."
else else
error "Unable to create the compressed package $package." error "Unable to create the compressed package $package."
@ -202,8 +197,7 @@ if [ -n "$PKGMK_INSTALL_COMMAND" ]; then
{ error "Cannot run pkgadd as a non-root user."; exit "$E_INSTALL"; } { error "Cannot run pkgadd as a non-root user."; exit "$E_INSTALL"; }
$PKGMK_SU $PKGMK_INSTALL_COMMAND "$pkg_dir$package" \ $PKGMK_SU $PKGMK_INSTALL_COMMAND "$pkg_dir$package" \
&& info "pkgadd $package succeeded." || \ && info "pkgadd $package succeeded." || \
{ error "pkgadd $package failed."; { error "pkgadd $package failed."; exit "$E_INSTALL"; }
exit "$E_INSTALL"; }
fi fi
# Done! # Done!
@ -363,7 +357,7 @@ fetch_url() {
# Did the port maintainer specify a branch other than 'main'? # Did the port maintainer specify a branch other than 'main'?
tag="${giturl##*\#}" tag="${giturl##*\#}"
[ "$tag" = "$giturl" ] || { giturl="${giturl%\#*}"; [ "$tag" = "$giturl" ] || { giturl="${giturl%\#*}";
CLONE_ARGS="-c advice.detachedHead=false --branch $tag"; } CLONE_ARGS=(-c advice.detachedHead=false --branch "$tag"); }
# #
# Has this project been downloaded before? # Has this project been downloaded before?
if [ -d "$src_dir/$h.partial" ]; then if [ -d "$src_dir/$h.partial" ]; then
@ -371,7 +365,7 @@ fetch_url() {
"$PKGMK_GIT_COMMAND" pull "$giturl" "$tag" "$PKGMK_GIT_COMMAND" pull "$giturl" "$tag"
finished=$?; cd .. finished=$?; cd ..
else else
"$PKGMK_GIT_COMMAND" clone "$giturl" $CLONE_ARGS "$h.partial" "$PKGMK_GIT_COMMAND" clone "$giturl" "${CLONE_ARGS[@]}" "$h.partial"
finished=$?; [ "$src_dir" = "" ] || { mv "$h.partial" "$src_dir"; finished=$?; [ "$src_dir" = "" ] || { mv "$h.partial" "$src_dir";
ln -s "$src_dir/$h.partial" "$h"; } ln -s "$src_dir/$h.partial" "$h"; }
fi fi
@ -464,7 +458,9 @@ parse_signify_output() { # chomps the output of check_signature()
check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile", check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile",
# otherwise called from within $work. # otherwise called from within $work.
local reqfiles=(Pkgfile); local s=0; local when="$1"; local reqfiles=(Pkgfile); local s=0; local when="$1";
local SIGNIFY_ARGS=(-C -x "$PKGMK_ROOT/.signature")
[ "$PKGMK_PUBLICKEY" ] || PKGMK_PUBLICKEY=$(repo_key public)
if [ -f "$PKGMK_ROOT/.signature" ]; then if [ -f "$PKGMK_ROOT/.signature" ]; then
[ "$when" = "pre-Pkgfile" ] || reqfiles=(.footprint) [ "$when" = "pre-Pkgfile" ] || reqfiles=(.footprint)
while [ "$when" = "pre-build" ] && [ "$s" -lt ${#_local_[@]} ]; do while [ "$when" = "pre-build" ] && [ "$s" -lt ${#_local_[@]} ]; do
@ -474,63 +470,62 @@ check_signature() { # called from $PKGMK_ROOT in the case "when"="pre-Pkgfile",
for FILE in "${reqfiles[@]}"; do for FILE in "${reqfiles[@]}"; do
[ -e "$FILE" ] || ln -sf "$PKGMK_ROOT/$FILE" . [ -e "$FILE" ] || ln -sf "$PKGMK_ROOT/$FILE" .
done done
if [ -f "$PKGMK_PUBLICKEY" ]; then [ -f "$PKGMK_PUBLICKEY" ] && SIGNIFY_ARGS+=(-p "$PKGMK_PUBLICKEY")
/usr/bin/signify -C -p "$PKGMK_PUBLICKEY" -x "$PKGMK_ROOT/.signature" \ /usr/bin/signify "${SIGNIFY_ARGS[@]}" "${reqfiles[@]}" 2>&1
"${reqfiles[@]}" 2>&1
else
/usr/bin/signify -C -x "$PKGMK_ROOT/.signature" \
"${reqfiles[@]}" 2>&1
fi
else else
[ "$when" = "pre-Pkgfile" ] && echo "Pkgfile verification failed" [ "$when" = "pre-Pkgfile" ] && echo "Pkgfile verification failed"
[ "$when" != "pre-Pkgfile" ] && echo "signature verification failed" [ "$when" != "pre-Pkgfile" ] && echo "signature verification failed"
fi fi
} }
cat_signature() { repo_key() {
local ordered si key pub local typ="${1:0:3}"
[ -e "$PKGMK_ROOT/.footprint" ] || warning "Footprint not found, signature will be incomplete." for key in "/etc/ports/*.$typ" "$HOME/.ssh/*.$typ"; do
for key in ~/.ssh/*.sec /etc/ports/*.sec; do [ -e "$key" ] || continue
[ -e "$key" ] || continue # workaround for brain-dead shell globbing REPO="$(dirname "$PWD")"; REPO="$(basename -s .git "$REPO")";
pub="/etc/ports/$(basename "${key%.sec}.pub")" [ "$REPO" = "$(basename -s ".$typ" "$key")" ] && { echo "$key"; break; }
if [ -e "$pub" ]; then
pub=$(readlink -f "$pub")
for f in "$PKGMK_ROOT/Pkgfile" "$PKGMK_ROOT/.footprint"; do
[ -e "$f" ] && ordered+=( "$f" )
done
for ((si=0; si < ${#source[@]}; si++)); do
# ignore git directories when writing the signature
[[ "${source[si]}" =~ ^__git__ ]] || ordered+=("${_local_[si]}"); done
sha256sum --tag "${ordered[@]}" \
| sed 's|^SHA256 (.*/\(.*\))\(.* = .*\)|SHA256 (\1)\2|' \
| /usr/bin/signify -S -e -x - -q -s "$key" -m - \
| sed "s|${key%.sec}.pub|$pub|"
break
fi
done done
} }
refresh_signature() { make_signature() {
[ -e ".signature" ] || { error "missing .signature, cannot refresh."; return $E_SIGNATURE; } local ordered si pub
[ -w ".signature" ] || { error ".signature not writable."; return $E_DIRPERM; } [ -w "$PKGMK_ROOT/.signature" ] || { error ".signature not writable."; return $E_DIRPERM; }
local REPO [ "$PKGMK_PRIVATEKEY" ] || PKGMK_PRIVATEKEY="$(repo_key secret)"
if [ -z "$PKGMK_PRIVATEKEY" ]; then [ -r "$PKGMK_PRIVATEKEY" ] && \
REPO="$(dirname "$PWD")" pub="/etc/ports/$(basename -s ".sec" "$PKGMK_PRIVATEKEY").pub" || \
REPO="${REPO##*/}" { error "No suitable secret key found. Specify one explicitly with '-sk'.";
REPO="${REPO%.git}" return $E_SIGNATURE; }
[ -r "/etc/ports/${REPO}.sec" ] && \
PKGMK_PRIVATEKEY="/etc/ports/${REPO}.sec" || \
{ error "No suitable secret key found. Specify one explicitly with '-sk'."; return $E_SIGNATURE; }
fi
if ! tail -n +3 ".signature" | /usr/bin/signify -S -e -x - -q \ # distinguish between creating .signature anew, vs. refreshing an existing manifest
-s "$PKGMK_PRIVATEKEY" -m - > .signature.tmp ; then case "$1" in
rm .signature.tmp new)
error "Refreshing signature failed"; return $E_SIGNATURE [ -e "$PKGMK_ROOT/.footprint" ] || \
else warning "Footprint not found, signature will be incomplete."
mv .signature.tmp .signature; info "Signature refreshed." for f in "$PKGMK_ROOT/Pkgfile" "$PKGMK_ROOT/.footprint"; do
fi [ -e "$f" ] && ordered+=( "$f" )
done
for ((si=0; si < ${#source[@]}; si++)); do
# ignore git directories when writing the signature
[[ "${source[si]}" =~ ^__git__ ]] || ordered+=("${_local_[si]}")
done
sha256sum --tag "${ordered[@]}" \
| sed 's|^SHA256 (.*/\(.*\))\(.* = .*\)|SHA256 (\1)\2|' \
| /usr/bin/signify -S -e -x - -q -s "$PKGMK_PRIVATEKEY" -m - \
| sed "s|${PKGMK_PRIVATEKEY%.sec}.pub|$pub|" \
> "$PKGMK_ROOT/.signature"
;;
refresh)
[ -e ".signature" ] || \
{ error "missing .signature, cannot refresh."; return $E_SIGNATURE; }
if tail -n +3 ".signature" | /usr/bin/signify -S -e -x - -q \
-s "$PKGMK_PRIVATEKEY" -m - > .signature.tmp; then
mv .signature.tmp .signature; info "Signature refreshed."
else
rm .signature.tmp; return $E_SIGNATURE
fi
;;
esac
} }
interrupted() { interrupted() {
@ -557,8 +552,7 @@ error() {
## Now ensure that they cannot be overwritten when sourcing Pkgfile ## ## Now ensure that they cannot be overwritten when sourcing Pkgfile ##
readonly -f main info warning error print_help parse_options validate_pkgfile \ readonly -f main info warning error print_help parse_options validate_pkgfile \
check_reqvars check_pkg_mtime fetch_url cat_footprint check_footprint \ check_reqvars check_pkg_mtime fetch_url cat_footprint check_footprint \
cat_signature check_signature parse_signify_output refresh_signature \ make_signature repo_key check_signature parse_signify_output cleanup_work
cleanup_work
trap "interrupted" SIGHUP SIGINT SIGQUIT SIGTERM trap "interrupted" SIGHUP SIGINT SIGQUIT SIGTERM
export LC_ALL=C.UTF-8 export LC_ALL=C.UTF-8