35 #undef ZYPP_BASE_LOGGER_LOGGROUP 36 #define ZYPP_BASE_LOGGER_LOGGROUP "zypp::KeyRing" 39 #define GPG_BINARY "/usr/bin/gpg2" 53 {
return _keyRingDefaultAccept; }
57 MIL <<
"Set new KeyRing::DefaultAccept: " << value_r << endl;
58 _keyRingDefaultAccept = value_r;
71 return KEY_TRUST_TEMPORARILY;
73 return KEY_TRUST_AND_IMPORT;
74 return KEY_DONT_TRUST;
92 struct CachedPublicKeyData
94 const std::list<PublicKeyData> & operator()(
const Pathname & keyring_r )
const 95 {
return getData( keyring_r ); }
103 Cache(
const Cache & rhs ) {}
105 void assertCache(
const Pathname & keyring_r )
114 bool hasChanged()
const 128 typedef std::map<Pathname,Cache> CacheMap;
130 const std::list<PublicKeyData> & getData(
const Pathname & keyring_r )
const 134 cache.assertCache( keyring_r );
135 return getData( keyring_r, cache );
138 const std::list<PublicKeyData> & getData(
const Pathname & keyring_r, Cache & cache_r )
const 140 if ( cache_r.hasChanged() )
145 "--list-public-keys",
146 "--homedir", keyring_r.c_str(),
147 "--no-default-keyring",
151 "--with-fingerprint",
160 PublicKeyScanner scanner;
162 for( std::string line = prog.receiveLine(); !line.empty(); line = prog.receiveLine() )
164 scanner.scan( line );
168 cache_r._data.swap( scanner._keys );
169 MIL <<
"Found keys: " << cache_r._data << endl;
171 return cache_r._data;
186 Impl(
const Pathname & baseTmpDir )
187 : _trusted_tmp_dir( baseTmpDir,
"zypp-trusted-kr" )
188 , _general_tmp_dir( baseTmpDir,
"zypp-general-kr" )
189 , _base_dir( baseTmpDir )
191 MIL <<
"Current KeyRing::DefaultAccept: " << _keyRingDefaultAccept << endl;
195 void multiKeyImport(
const Pathname & keyfile_r,
bool trusted_r =
false );
196 void deleteKey(
const std::string &
id,
bool trusted );
201 {
return bool(publicKeyExists(
id, trustedKeyRing() )); }
203 {
return publicKeyExists(
id, trustedKeyRing() ) || publicKeyExists(
id, generalKeyRing() ); }
215 void dumpPublicKey(
const std::string &
id,
bool trusted, std::ostream & stream )
216 {
dumpPublicKey(
id, ( trusted ? trustedKeyRing() : generalKeyRing() ), stream ); }
219 {
return exportKey( keyData, generalKeyRing() ); }
221 {
return exportKey( keyData, trustedKeyRing() ); }
226 {
return verifyFile( file, signature, generalKeyRing() ); }
228 {
return verifyFile( file, signature, trustedKeyRing() ); }
231 bool verifyFile(
const Pathname & file,
const Pathname & signature,
const Pathname & keyring );
232 void importKey(
const Pathname & keyfile,
const Pathname & keyring );
234 PublicKey exportKey(
const std::string &
id,
const Pathname & keyring );
237 void dumpPublicKey(
const std::string &
id,
const Pathname & keyring, std::ostream & stream );
238 filesystem::TmpFile dumpPublicKeyToTmp(
const std::string &
id,
const Pathname & keyring );
240 void deleteKey(
const std::string &
id,
const Pathname & keyring );
242 std::list<PublicKey>
publicKeys(
const Pathname & keyring);
244 {
return cachedPublicKeyData( keyring ); }
247 PublicKeyData publicKeyExists(
const std::string &
id,
const Pathname & keyring );
250 {
return _general_tmp_dir.path(); }
252 {
return _trusted_tmp_dir.path(); }
272 importKey( key.
path(), trusted ? trustedKeyRing() : generalKeyRing() );
279 rpmdbEmitSignal->trustedKeyAdded( key );
280 emitSignal->trustedKeyAdded( key );
286 importKey( keyfile_r, trusted_r ? trustedKeyRing() : generalKeyRing() );
295 key = exportKey(
id, trustedKeyRing() );
298 deleteKey(
id, trusted ? trustedKeyRing() : generalKeyRing() );
305 rpmdbEmitSignal->trustedKeyRemoved( key );
306 emitSignal->trustedKeyRemoved( key );
312 MIL <<
"Searching key [" <<
id <<
"] in keyring " << keyring << endl;
313 const std::list<PublicKeyData> & keys(
publicKeyData( keyring ) );
314 for_( it, keys.begin(), keys.end() )
316 if (
id == (*it).id() )
326 return PublicKey( dumpPublicKeyToTmp( keyData.
id(), keyring ), keyData );
333 return PublicKey( dumpPublicKeyToTmp( keyData.
id(), keyring ), keyData );
336 WAR <<
"No key " <<
id <<
" to export from " << keyring << endl;
348 "--homedir", keyring.asString().c_str(),
349 "--no-default-keyring",
353 "--no-permission-warning",
369 MIL <<
"Going to export key " <<
id <<
" from " << keyring <<
" to " << tmpFile.
path() << endl;
371 std::ofstream os( tmpFile.
path().
c_str() );
382 MIL <<
"Going to verify signature for " << filedesc <<
" ( " << file <<
" ) with " << signature << endl;
385 if( signature.empty() || (!PathInfo( signature ).isExist()) )
387 bool res = report->askUserToAcceptUnsignedFile( filedesc, context );
388 MIL <<
"askUserToAcceptUnsignedFile: " << res << endl;
396 PublicKeyData trustedKeyData( publicKeyExists(
id, trustedKeyRing() ) );
397 if ( trustedKeyData )
399 MIL <<
"Key is trusted: " << trustedKeyData << endl;
403 PublicKeyData generalKeyData( publicKeyExists(
id, generalKeyRing() ) );
404 if ( generalKeyData )
411 MIL <<
"Key was updated. Saving new version into trusted keyring: " << generalKeyData << endl;
412 importKey( exportKey( generalKeyData, generalKeyRing() ),
true );
413 trustedKeyData = publicKeyExists(
id, trustedKeyRing() );
418 report->infoVerify( filedesc, trustedKeyData, context );
419 if ( verifyFile( file, signature, trustedKeyRing() ) )
421 return (sigValid_r=
true);
425 bool res = report->askUserToAcceptVerificationFailed( filedesc, exportKey( trustedKeyData, trustedKeyRing() ), context );
426 MIL <<
"askUserToAcceptVerificationFailed: " << res << endl;
432 PublicKeyData generalKeyData( publicKeyExists(
id, generalKeyRing() ) );
433 if ( generalKeyData )
435 PublicKey key( exportKey( generalKeyData, generalKeyRing() ) );
436 MIL <<
"Exported key " <<
id <<
" to " << key.
path() << endl;
437 MIL <<
"Key " <<
id <<
" " << key.
name() <<
" is not trusted" << endl;
444 MIL <<
"User wants to trust key " <<
id <<
" " << key.
name() << endl;
446 Pathname whichKeyring;
449 MIL <<
"User wants to import key " <<
id <<
" " << key.
name() << endl;
451 whichKeyring = trustedKeyRing();
454 whichKeyring = generalKeyRing();
457 report->infoVerify( filedesc, generalKeyData, context );
458 if ( verifyFile( file, signature, whichKeyring ) )
460 return (sigValid_r=
true);
464 bool res = report->askUserToAcceptVerificationFailed( filedesc, key, context );
465 MIL <<
"askUserToAcceptVerificationFailed: " << res << endl;
471 MIL <<
"User does not want to trust key " <<
id <<
" " << key.
name() << endl;
478 MIL <<
"File [" << file <<
"] ( " << filedesc <<
" ) signed with unknown key [" <<
id <<
"]" << endl;
479 bool res = report->askUserToAcceptUnknownKey( filedesc,
id, context );
480 MIL <<
"askUserToAcceptUnknownKey: " << res << endl;
489 const std::list<PublicKeyData> & keys(
publicKeyData( keyring ) );
490 std::list<PublicKey> ret;
492 for_( it, keys.begin(), keys.end() )
494 PublicKey key( exportKey( *it, keyring ) );
495 ret.push_back( key );
496 MIL <<
"Found key " << key << endl;
503 if ( ! PathInfo( keyfile ).isExist() )
507 % keyring.asString() ));
513 "--homedir", keyring.asString().c_str(),
514 "--no-default-keyring",
518 "--no-permission-warning",
520 keyfile.asString().c_str(),
534 "--homedir", keyring.asString().c_str(),
535 "--no-default-keyring",
547 int code = prog.
close();
551 MIL <<
"Deleted key " <<
id <<
" from keyring " << keyring << endl;
557 if ( ! PathInfo( signature ).isFile() )
560 MIL <<
"Determining key id of signature " << signature << endl;
568 "--homedir", tmppath.c_str(),
569 "--no-default-keyring",
575 signature.asString().c_str(),
584 str::regex rxNoKey(
"^\\[GNUPG:\\] NO_PUBKEY (.+)\n$" );
592 if ( what.
size() >= 1 )
603 MIL <<
"no output" << endl;
606 MIL <<
"Determined key id [" <<
id <<
"] for signature " << signature << endl;
617 "--homedir", keyring.asString().c_str(),
618 "--no-default-keyring",
624 signature.asString().c_str(),
625 file.asString().c_str(),
641 return ( prog.
close() == 0 ) ?
true :
false;
void importKey(const PublicKey &key, bool trusted=false)
imports a key from a file.
const std::list< PublicKeyData > & publicKeyData()
PublicKey exportTrustedPublicKey(const PublicKeyData &keyData)
Export a trusted public key identified by its key data.
PublicKey exportPublicKey(const PublicKeyData &keyData)
const Pathname trustedKeyRing() const
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
void deleteKey(const std::string &id, bool trusted)
PublicKey exportKey(const std::string &id, const Pathname &keyring)
bool isKeyTrusted(const std::string &id)
#define ZYPP_THROW(EXCPT)
Drops a logline and throws the Exception.
const std::list< PublicKeyData > & trustedPublicKeyData()
This basically means, we knew the key, but it was not trusted.
PublicKey exportPublicKey(const PublicKeyData &keyData)
Export a public key identified by its key data.
Class representing one GPG Public Keys data.
const std::string & asString() const
String representation.
bool isKeyKnown(const std::string &id)
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
PublicKeyData publicKeyExists(const std::string &id, const Pathname &keyring)
Get PublicKeyData for ID (false if ID is not found).
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
std::list< PublicKey > trustedPublicKeys()
Get a list of trusted public keys in the keyring (incl.
bool verifyFile(const Pathname &file, const Pathname &signature, const Pathname &keyring)
virtual bool askUserToAcceptUnsignedFile(const std::string &file, const KeyContext &keycontext=KeyContext())
KeyRing(const Pathname &baseTmpDir)
Default ctor.
std::list< PublicKeyData > trustedPublicKeyData()
Get a list of trusted public key data in the keyring (key data only)
bool verifyFileSignatureWorkflow(const Pathname &file, const std::string &filedesc, const Pathname &signature, bool &sigValid_r, const KeyContext &keycontext=KeyContext())
Follows a signature verification interacting with the user.
#define for_(IT, BEG, END)
Convenient for-loops using iterator.
Provide a new empty temporary file and delete it when no longer needed.
virtual bool askUserToAcceptUnknownKey(const std::string &file, const std::string &id, const KeyContext &keycontext=KeyContext())
we DONT know the key, only its id, but we have never seen it, the difference with trust key is that i...
CachedPublicKeyData cachedPublicKeyData
Functor returning the keyrings data (cached).
Remember a files attributes to detect content changes.
virtual void infoVerify(const std::string &file_r, const PublicKeyData &keyData_r, const KeyContext &keycontext=KeyContext())
Informal callback showing the trusted key that will be used for verification.
PublicKey exportTrustedPublicKey(const PublicKeyData &keyData)
KeyTrust
User reply options for the askUserToTrustKey callback.
Pathname path() const
File containig the ASCII armored key.
static void setDefaultAccept(DefaultAccept value_r)
Set the active accept bits.
Provide a new empty temporary directory and recursively delete it when no longer needed.
filesystem::TmpDir _trusted_tmp_dir
bool verifyFileSignature(const Pathname &file, const Pathname &signature)
Execute a program and give access to its io An object of this class encapsulates the execution of an ...
std::list< PublicKeyData > _data
bool verifyFileSignatureWorkflow(const Pathname &file, const std::string &filedesc, const Pathname &signature, bool &sigValid_r, const KeyContext &keycontext=KeyContext())
filesystem::TmpFile dumpPublicKeyToTmp(const std::string &id, const Pathname &keyring)
const char * c_str() const
String representation.
std::string fingerprint() const
Key fingerprint.
IMPL_PTR_TYPE(Application)
std::list< PublicKey > trustedPublicKeys()
scoped_ptr< WatchFile > _keyringP
void importKey(const PublicKey &key, bool trusted=false)
std::string receiveLine()
Read one line from the input stream.
Impl(const Pathname &baseTmpDir)
bool isKeyKnown(const std::string &id)
true if the key id is knows, that means at least exist on the untrusted keyring
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
Initial import from RpmDb.
const Pathname generalKeyRing() const
int close()
Wait for the progamm to complete.
virtual KeyTrust askUserToAcceptKey(const PublicKey &key, const KeyContext &keycontext=KeyContext())
Ask user to trust and/or import the key to trusted keyring.
scoped_ptr< WatchFile > _keyringK
static DefaultAccept defaultAccept()
Get the active accept bits.
RW_pointer< Impl > _pimpl
Pointer to implementation.
Regular expression match result.
Class representing one GPG Public Key (PublicKeyData + ASCII armored in a tempfile).
std::list< PublicKeyData > publicKeyData()
Get a list of public key data in the keyring (key data only)
Base class for Exception.
std::list< PublicKey > publicKeys()
std::string id() const
Key ID.
void deleteKey(const std::string &id, bool trusted=false)
removes a key from the keyring.
bool verifyFileTrustedSignature(const Pathname &file, const Pathname &signature)
bool verifyFileTrustedSignature(const Pathname &file, const Pathname &signature)
bool regex_match(const std::string &s, smatch &matches, const regex ®ex)
regex ZYPP_STR_REGEX regex ZYPP_STR_REGEX
const std::list< PublicKeyData > & publicKeyData(const Pathname &keyring)
bool isKeyTrusted(const std::string &id)
true if the key id is trusted
Date created() const
Creation / last modification date (latest selfsig).
Easy-to use interface to the ZYPP dependency resolver.
std::string readSignatureKeyId(const Pathname &signature)
reads the public key id from a signature
bool verifyFileSignature(const Pathname &file, const Pathname &signature)
Verifies a file against a signature, with no user interaction.
std::string readSignatureKeyId(const Pathname &signature)
virtual bool askUserToAcceptVerificationFailed(const std::string &file, const PublicKey &key, const KeyContext &keycontext=KeyContext())
The file filedesc is signed but the verification failed.
std::list< PublicKey > publicKeys()
Get a list of public keys in the keyring (incl.
filesystem::TmpDir _general_tmp_dir