libzypp  16.17.7
KeyRing.cc
Go to the documentation of this file.
1 /*---------------------------------------------------------------------\
2 | ____ _ __ __ ___ |
3 | |__ / \ / / . \ . \ |
4 | / / \ V /| _/ _/ |
5 | / /__ | | | | | | |
6 | /_____||_| |_| |_| |
7 | |
8 \---------------------------------------------------------------------*/
12 #include <iostream>
13 #include <fstream>
14 #include <sys/file.h>
15 #include <cstdio>
16 #include <unistd.h>
17 
18 #include "zypp/TmpPath.h"
19 #include "zypp/ZYppFactory.h"
20 #include "zypp/ZYpp.h"
21 
22 #include "zypp/base/LogTools.h"
23 #include "zypp/base/IOStream.h"
24 #include "zypp/base/String.h"
25 #include "zypp/base/Regex.h"
26 #include "zypp/base/Gettext.h"
27 #include "zypp/base/WatchFile.h"
28 #include "zypp/PathInfo.h"
29 #include "zypp/KeyRing.h"
30 #include "zypp/ExternalProgram.h"
31 #include "zypp/TmpPath.h"
32 #include "zypp/ZYppCallbacks.h" // JobReport::instance
33 
34 using std::endl;
35 
36 #undef ZYPP_BASE_LOGGER_LOGGROUP
37 #define ZYPP_BASE_LOGGER_LOGGROUP "zypp::KeyRing"
38 
40 #define GPG_BINARY "/usr/bin/gpg2"
41 
43 namespace zypp
44 {
45 
46  IMPL_PTR_TYPE(KeyRing);
47 
48  namespace
49  {
50  KeyRing::DefaultAccept _keyRingDefaultAccept( KeyRing::ACCEPT_NOTHING );
51  }
52 
53  KeyRing::DefaultAccept KeyRing::defaultAccept()
54  { return _keyRingDefaultAccept; }
55 
56  void KeyRing::setDefaultAccept( DefaultAccept value_r )
57  {
58  MIL << "Set new KeyRing::DefaultAccept: " << value_r << endl;
59  _keyRingDefaultAccept = value_r;
60  }
61 
62  void KeyRingReport::infoVerify( const std::string & file_r, const PublicKeyData & keyData_r, const KeyContext & keycontext )
63  {}
64 
65  bool KeyRingReport::askUserToAcceptUnsignedFile( const std::string & file, const KeyContext & keycontext )
66  { return _keyRingDefaultAccept.testFlag( KeyRing::ACCEPT_UNSIGNED_FILE ); }
67 
69  KeyRingReport::askUserToAcceptKey( const PublicKey & key, const KeyContext & keycontext )
70  {
71  if ( _keyRingDefaultAccept.testFlag( KeyRing::TRUST_KEY_TEMPORARILY ) )
72  return KEY_TRUST_TEMPORARILY;
73  if ( _keyRingDefaultAccept.testFlag( KeyRing::TRUST_AND_IMPORT_KEY ) )
74  return KEY_TRUST_AND_IMPORT;
75  return KEY_DONT_TRUST;
76  }
77 
78  bool KeyRingReport::askUserToAcceptUnknownKey( const std::string & file, const std::string & id, const KeyContext & keycontext )
79  { return _keyRingDefaultAccept.testFlag( KeyRing::ACCEPT_UNKNOWNKEY ); }
80 
81  bool KeyRingReport::askUserToAcceptVerificationFailed( const std::string & file, const PublicKey & key, const KeyContext & keycontext )
82  { return _keyRingDefaultAccept.testFlag( KeyRing::ACCEPT_VERIFICATION_FAILED ); }
83 
84  namespace
85  {
93  struct CachedPublicKeyData // : private base::NonCopyable - but KeyRing uses RWCOW though also NonCopyable :(
94  {
95  const std::list<PublicKeyData> & operator()( const Pathname & keyring_r ) const
96  { return getData( keyring_r ); }
97 
98  private:
99  struct Cache
100  {
101  // Empty copy ctor to allow insert into std::map as
102  // scoped_ptr is noncopyable.
103  Cache() {}
104  Cache( const Cache & rhs ) {}
105 
106  void assertCache( const Pathname & keyring_r )
107  {
108  // .kbx since gpg2-2.1
109  if ( !_keyringK )
110  _keyringK.reset( new WatchFile( keyring_r/"pubring.kbx", WatchFile::NO_INIT ) );
111  if ( !_keyringP )
112  _keyringP.reset( new WatchFile( keyring_r/"pubring.gpg", WatchFile::NO_INIT ) );
113  }
114 
115  bool hasChanged() const
116  {
117  bool k = _keyringK->hasChanged(); // be sure both files are checked
118  bool p = _keyringP->hasChanged();
119  return k || p;
120  }
121 
122  std::list<PublicKeyData> _data;
123 
124  private:
127  };
128 
129  typedef std::map<Pathname,Cache> CacheMap;
130 
131  const std::list<PublicKeyData> & getData( const Pathname & keyring_r ) const
132  {
133  Cache & cache( _cacheMap[keyring_r] );
134  // init new cache entry
135  cache.assertCache( keyring_r );
136  return getData( keyring_r, cache );
137  }
138 
139  const std::list<PublicKeyData> & getData( const Pathname & keyring_r, Cache & cache_r ) const
140  {
141  if ( cache_r.hasChanged() )
142  {
143  const char* argv[] =
144  {
145  GPG_BINARY,
146  "--list-public-keys",
147  "--homedir", keyring_r.c_str(),
148  "--no-default-keyring",
149  "--quiet",
150  "--with-colons",
151  "--fixed-list-mode",
152  "--with-fingerprint",
153  "--with-sig-list",
154  "--no-tty",
155  "--no-greeting",
156  "--batch",
157  "--status-fd", "1",
158  NULL
159  };
160 
161  PublicKeyScanner scanner;
162  ExternalProgram prog( argv ,ExternalProgram::Discard_Stderr, false, -1, true );
163  for( std::string line = prog.receiveLine(); !line.empty(); line = prog.receiveLine() )
164  {
165  scanner.scan( line );
166  }
167  prog.close();
168 
169  cache_r._data.swap( scanner._keys );
170  MIL << "Found keys: " << cache_r._data << endl;
171  }
172  return cache_r._data;
173  }
174 
175  mutable CacheMap _cacheMap;
176  };
178  }
179 
181  //
182  // CLASS NAME : KeyRing::Impl
183  //
186  {
187  Impl( const Pathname & baseTmpDir )
188  : _trusted_tmp_dir( baseTmpDir, "zypp-trusted-kr" )
189  , _general_tmp_dir( baseTmpDir, "zypp-general-kr" )
190  , _base_dir( baseTmpDir )
191  {
192  MIL << "Current KeyRing::DefaultAccept: " << _keyRingDefaultAccept << endl;
193  }
194 
195  void importKey( const PublicKey & key, bool trusted = false );
196  void multiKeyImport( const Pathname & keyfile_r, bool trusted_r = false );
197  void deleteKey( const std::string & id, bool trusted );
198 
199  std::string readSignatureKeyId( const Pathname & signature );
200 
201  bool isKeyTrusted( const std::string & id )
202  { return bool(publicKeyExists( id, trustedKeyRing() )); }
203  bool isKeyKnown( const std::string & id )
204  { return publicKeyExists( id, trustedKeyRing() ) || publicKeyExists( id, generalKeyRing() ); }
205 
206  std::list<PublicKey> trustedPublicKeys()
207  { return publicKeys( trustedKeyRing() ); }
208  std::list<PublicKey> publicKeys()
209  { return publicKeys( generalKeyRing() ); }
210 
211  const std::list<PublicKeyData> & trustedPublicKeyData()
212  { return publicKeyData( trustedKeyRing() ); }
213  const std::list<PublicKeyData> & publicKeyData()
214  { return publicKeyData( generalKeyRing() ); }
215 
216  void dumpPublicKey( const std::string & id, bool trusted, std::ostream & stream )
217  { dumpPublicKey( id, ( trusted ? trustedKeyRing() : generalKeyRing() ), stream ); }
218 
220  { return exportKey( keyData, generalKeyRing() ); }
222  { return exportKey( keyData, trustedKeyRing() ); }
223 
224  bool verifyFileSignatureWorkflow( const Pathname & file, const std::string & filedesc, const Pathname & signature, bool & sigValid_r, const KeyContext & keycontext = KeyContext());
225 
226  bool verifyFileSignature( const Pathname & file, const Pathname & signature )
227  { return verifyFile( file, signature, generalKeyRing() ); }
228  bool verifyFileTrustedSignature( const Pathname & file, const Pathname & signature )
229  { return verifyFile( file, signature, trustedKeyRing() ); }
230 
231  private:
232  bool verifyFile( const Pathname & file, const Pathname & signature, const Pathname & keyring );
233  void importKey( const Pathname & keyfile, const Pathname & keyring );
234 
235  PublicKey exportKey( const std::string & id, const Pathname & keyring );
236  PublicKey exportKey( const PublicKeyData & keyData, const Pathname & keyring );
237 
238  void dumpPublicKey( const std::string & id, const Pathname & keyring, std::ostream & stream );
239  filesystem::TmpFile dumpPublicKeyToTmp( const std::string & id, const Pathname & keyring );
240 
241  void deleteKey( const std::string & id, const Pathname & keyring );
242 
243  std::list<PublicKey> publicKeys( const Pathname & keyring);
244  const std::list<PublicKeyData> & publicKeyData( const Pathname & keyring )
245  { return cachedPublicKeyData( keyring ); }
246 
248  PublicKeyData publicKeyExists( const std::string & id, const Pathname & keyring );
249 
250  const Pathname generalKeyRing() const
251  { return _general_tmp_dir.path(); }
252  const Pathname trustedKeyRing() const
253  { return _trusted_tmp_dir.path(); }
254 
255  // Used for trusted and untrusted keyrings
258  Pathname _base_dir;
259 
260  private:
266  CachedPublicKeyData cachedPublicKeyData;
267  };
269 
270 
271  void KeyRing::Impl::importKey( const PublicKey & key, bool trusted )
272  {
273  importKey( key.path(), trusted ? trustedKeyRing() : generalKeyRing() );
274 
275  if ( trusted )
276  try {
278  rpmdbEmitSignal->trustedKeyAdded( key );
279 
281  emitSignal->trustedKeyAdded( key );
282  }
283  catch ( const Exception & excp )
284  {
285  ERR << "Could not import key " << excp << endl;
286  // TODO: JobReport as hotfix for bsc#1057188; should bubble up and go through some callback
288  }
289  }
290 
291  void KeyRing::Impl::multiKeyImport( const Pathname & keyfile_r, bool trusted_r )
292  {
293  importKey( keyfile_r, trusted_r ? trustedKeyRing() : generalKeyRing() );
294  }
295 
296  void KeyRing::Impl::deleteKey( const std::string & id, bool trusted )
297  {
298  deleteKey( id, trusted ? trustedKeyRing() : generalKeyRing() );
299 
300  if ( trusted )
301  try {
302  PublicKey key( exportKey( id, trustedKeyRing() ) );
303 
305  rpmdbEmitSignal->trustedKeyRemoved( key );
306 
308  emitSignal->trustedKeyRemoved( key );
309  }
310  catch ( const Exception & excp )
311  {
312  ERR << "Could not delete key " << excp << endl;
313  // TODO: JobReport as hotfix for bsc#1057188; should bubble up and go through some callback
315  }
316  }
317 
318  PublicKeyData KeyRing::Impl::publicKeyExists( const std::string & id, const Pathname & keyring )
319  {
320  MIL << "Searching key [" << id << "] in keyring " << keyring << endl;
321  PublicKeyData ret;
322  for ( const PublicKeyData & key : publicKeyData( keyring ) )
323  {
324  if ( key.providesKey( id ) )
325  {
326  ret = key;
327  break;
328  }
329  }
330  return ret;
331  }
332 
333  PublicKey KeyRing::Impl::exportKey( const PublicKeyData & keyData, const Pathname & keyring )
334  {
335  return PublicKey( dumpPublicKeyToTmp( keyData.id(), keyring ), keyData );
336  }
337 
338  PublicKey KeyRing::Impl::exportKey( const std::string & id, const Pathname & keyring )
339  {
340  PublicKeyData keyData( publicKeyExists( id, keyring ) );
341  if ( keyData )
342  return PublicKey( dumpPublicKeyToTmp( keyData.id(), keyring ), keyData );
343 
344  // Here: key not found
345  WAR << "No key " << id << " to export from " << keyring << endl;
346  return PublicKey();
347  }
348 
349 
350  void KeyRing::Impl::dumpPublicKey( const std::string & id, const Pathname & keyring, std::ostream & stream )
351  {
352  const char* argv[] =
353  {
354  GPG_BINARY,
355  "-a",
356  "--export",
357  "--homedir", keyring.asString().c_str(),
358  "--no-default-keyring",
359  "--quiet",
360  "--no-tty",
361  "--no-greeting",
362  "--no-permission-warning",
363  "--batch",
364  id.c_str(),
365  NULL
366  };
367  ExternalProgram prog( argv,ExternalProgram::Discard_Stderr, false, -1, true );
368  for ( std::string line = prog.receiveLine(); !line.empty(); line = prog.receiveLine() )
369  {
370  stream << line;
371  }
372  prog.close();
373  }
374 
375  filesystem::TmpFile KeyRing::Impl::dumpPublicKeyToTmp( const std::string & id, const Pathname & keyring )
376  {
377  filesystem::TmpFile tmpFile( _base_dir, "pubkey-"+id+"-" );
378  MIL << "Going to export key " << id << " from " << keyring << " to " << tmpFile.path() << endl;
379 
380  std::ofstream os( tmpFile.path().c_str() );
381  dumpPublicKey( id, keyring, os );
382  os.close();
383  return tmpFile;
384  }
385 
386  bool KeyRing::Impl::verifyFileSignatureWorkflow( const Pathname & file, const std::string & filedesc, const Pathname & signature, bool & sigValid_r, const KeyContext & context )
387  {
388  sigValid_r = false; // set true if signature is actually successfully validated!
389 
391  MIL << "Going to verify signature for " << filedesc << " ( " << file << " ) with " << signature << endl;
392 
393  // if signature does not exists, ask user if he wants to accept unsigned file.
394  if( signature.empty() || (!PathInfo( signature ).isExist()) )
395  {
396  bool res = report->askUserToAcceptUnsignedFile( filedesc, context );
397  MIL << "askUserToAcceptUnsignedFile: " << res << endl;
398  return res;
399  }
400 
401  // get the id of the signature (it might be a subkey id!)
402  std::string id = readSignatureKeyId( signature );
403 
404  // does key exists in trusted keyring
405  PublicKeyData trustedKeyData( publicKeyExists( id, trustedKeyRing() ) );
406  if ( trustedKeyData )
407  {
408  MIL << "Key is trusted: " << trustedKeyData << endl;
409 
410  // lets look if there is an updated key in the
411  // general keyring
412  PublicKeyData generalKeyData( publicKeyExists( id, generalKeyRing() ) );
413  if ( generalKeyData )
414  {
415  // bnc #393160: Comment #30: Compare at least the fingerprint
416  // in case an attacker created a key the the same id.
417  //
418  // FIXME: bsc#1008325: For keys using subkeys, we'd actually need
419  // to compare the subkey sets, to tell whether a key was updated.
420  // because created() remains unchanged if the primary key is not touched.
421  // For now we wait until a new subkey signs the data and treat it as a
422  // new key (else part below).
423  if ( trustedKeyData.fingerprint() == generalKeyData.fingerprint()
424  && trustedKeyData.created() < generalKeyData.created() )
425  {
426  MIL << "Key was updated. Saving new version into trusted keyring: " << generalKeyData << endl;
427  importKey( exportKey( generalKeyData, generalKeyRing() ), true );
428  trustedKeyData = publicKeyExists( id, trustedKeyRing() ); // re-read: invalidated by import?
429  }
430  }
431 
432  // it exists, is trusted, does it validate?
433  report->infoVerify( filedesc, trustedKeyData, context );
434  if ( verifyFile( file, signature, trustedKeyRing() ) )
435  {
436  return (sigValid_r=true); // signature is actually successfully validated!
437  }
438  else
439  {
440  bool res = report->askUserToAcceptVerificationFailed( filedesc, exportKey( trustedKeyData, trustedKeyRing() ), context );
441  MIL << "askUserToAcceptVerificationFailed: " << res << endl;
442  return res;
443  }
444  }
445  else
446  {
447  PublicKeyData generalKeyData( publicKeyExists( id, generalKeyRing() ) );
448  if ( generalKeyData )
449  {
450  PublicKey key( exportKey( generalKeyData, generalKeyRing() ) );
451  MIL << "Exported key " << id << " to " << key.path() << endl;
452  MIL << "Key " << id << " " << key.name() << " is not trusted" << endl;
453 
454  // ok the key is not trusted, ask the user to trust it or not
455  KeyRingReport::KeyTrust reply = report->askUserToAcceptKey( key, context );
456  if ( reply == KeyRingReport::KEY_TRUST_TEMPORARILY ||
458  {
459  MIL << "User wants to trust key " << id << " " << key.name() << endl;
460 
461  Pathname whichKeyring;
463  {
464  MIL << "User wants to import key " << id << " " << key.name() << endl;
465  importKey( key, true );
466  whichKeyring = trustedKeyRing();
467  }
468  else
469  whichKeyring = generalKeyRing();
470 
471  // does it validate?
472  report->infoVerify( filedesc, generalKeyData, context );
473  if ( verifyFile( file, signature, whichKeyring ) )
474  {
475  return (sigValid_r=true); // signature is actually successfully validated!
476  }
477  else
478  {
479  bool res = report->askUserToAcceptVerificationFailed( filedesc, key, context );
480  MIL << "askUserToAcceptVerificationFailed: " << res << endl;
481  return res;
482  }
483  }
484  else
485  {
486  MIL << "User does not want to trust key " << id << " " << key.name() << endl;
487  return false;
488  }
489  }
490  else
491  {
492  // signed with an unknown key...
493  MIL << "File [" << file << "] ( " << filedesc << " ) signed with unknown key [" << id << "]" << endl;
494  bool res = report->askUserToAcceptUnknownKey( filedesc, id, context );
495  MIL << "askUserToAcceptUnknownKey: " << res << endl;
496  return res;
497  }
498  }
499  return false;
500  }
501 
502  std::list<PublicKey> KeyRing::Impl::publicKeys( const Pathname & keyring )
503  {
504  const std::list<PublicKeyData> & keys( publicKeyData( keyring ) );
505  std::list<PublicKey> ret;
506 
507  for_( it, keys.begin(), keys.end() )
508  {
509  PublicKey key( exportKey( *it, keyring ) );
510  ret.push_back( key );
511  MIL << "Found key " << key << endl;
512  }
513  return ret;
514  }
515 
516  void KeyRing::Impl::importKey( const Pathname & keyfile, const Pathname & keyring )
517  {
518  if ( ! PathInfo( keyfile ).isExist() )
519  // TranslatorExplanation first %s is key name, second is keyring name
520  ZYPP_THROW(KeyRingException( str::Format(_("Tried to import not existent key %s into keyring %s"))
521  % keyfile.asString()
522  % keyring.asString() ));
523 
524  const char* argv[] =
525  {
526  GPG_BINARY,
527  "--import",
528  "--homedir", keyring.asString().c_str(),
529  "--no-default-keyring",
530  "--quiet",
531  "--no-tty",
532  "--no-greeting",
533  "--no-permission-warning",
534  "--status-fd", "1",
535  keyfile.asString().c_str(),
536  NULL
537  };
538 
539  ExternalProgram prog( argv,ExternalProgram::Discard_Stderr, false, -1, true );
540  prog.close();
541  }
542 
543  void KeyRing::Impl::deleteKey( const std::string & id, const Pathname & keyring )
544  {
545  const char* argv[] =
546  {
547  GPG_BINARY,
548  "--delete-keys",
549  "--homedir", keyring.asString().c_str(),
550  "--no-default-keyring",
551  "--yes",
552  "--quiet",
553  "--no-tty",
554  "--batch",
555  "--status-fd", "1",
556  id.c_str(),
557  NULL
558  };
559 
560  ExternalProgram prog( argv,ExternalProgram::Discard_Stderr, false, -1, true );
561 
562  int code = prog.close();
563  if ( code )
564  ZYPP_THROW(Exception(_("Failed to delete key.")));
565  else
566  MIL << "Deleted key " << id << " from keyring " << keyring << endl;
567  }
568 
569  std::string KeyRing::Impl::readSignatureKeyId( const Pathname & signature )
570  {
571  if ( ! PathInfo( signature ).isFile() )
572  ZYPP_THROW(Exception( str::Format(_("Signature file %s not found")) % signature.asString() ));
573 
574  MIL << "Determining key id of signature " << signature << endl;
575  const char* argv[] =
576  {
577  GPG_BINARY,
578  "--list-packets",
579  signature.asString().c_str(),
580  NULL
581  };
582  ExternalProgram prog( argv ,ExternalProgram::Discard_Stderr, false, -1, true );
583 
584  // :signature packet: algo 1, keyid 1397BC53640DB551
585  // version 4, created 1501094968, md5len 0, sigclass 0x00
586  // digest algo 8, begin of digest 15 89
587  // hashed subpkt 2 len 4 (sig created 2017-07-26)
588  // subpkt 16 len 8 (issuer key ID 1397BC53640DB551)
589  // data: [4095 bits]
590  std::string id;
591  for( std::string line = prog.receiveLine(); !line.empty(); line = prog.receiveLine() )
592  {
593  if ( id.empty() && str::startsWith( line, ":signature packet:" ) )
594  {
595  static const str::regex rxKeyId( " keyid +([0-9A-Z]+)" );
596  str::smatch what;
597  if( str::regex_match( line, what, rxKeyId ) )
598  id = what[1];
599  }
600  }
601 
602  MIL << "Determined key id [" << id << "] for signature " << signature << endl;
603  prog.close();
604  return id;
605  }
606 
607  bool KeyRing::Impl::verifyFile( const Pathname & file, const Pathname & signature, const Pathname & keyring )
608  {
609  const char* argv[] =
610  {
611  GPG_BINARY,
612  "--verify",
613  "--homedir", keyring.asString().c_str(),
614  "--no-default-keyring",
615  "--quiet",
616  "--no-tty",
617  "--batch",
618  "--no-greeting",
619  "--status-fd", "1",
620  signature.asString().c_str(),
621  file.asString().c_str(),
622  NULL
623  };
624 
625  // no need to parse output for now
626  // [GNUPG:] SIG_ID yCc4u223XRJnLnVAIllvYbUd8mQ 2006-03-29 1143618744
627  // [GNUPG:] GOODSIG A84EDAE89C800ACA SuSE Package Signing Key <build@suse.de>
628  // gpg: Good signature from "SuSE Package Signing Key <build@suse.de>"
629  // [GNUPG:] VALIDSIG 79C179B2E1C820C1890F9994A84EDAE89C800ACA 2006-03-29 1143618744 0 3 0 17 2 00 79C179B2E1C820C1890F9994A84EDAE89C800ACA
630  // [GNUPG:] TRUST_UNDEFINED
631 
632  // [GNUPG:] ERRSIG A84EDAE89C800ACA 17 2 00 1143618744 9
633  // [GNUPG:] NO_PUBKEY A84EDAE89C800ACA
634 
635  ExternalProgram prog( argv,ExternalProgram::Discard_Stderr, false, -1, true );
636 
637  return ( prog.close() == 0 ) ? true : false;
638  }
639 
641 
643  //
644  // CLASS NAME : KeyRing
645  //
647 
648  KeyRing::KeyRing( const Pathname & baseTmpDir )
649  : _pimpl( new Impl( baseTmpDir ) )
650  {}
651 
653  {}
654 
655 
656  void KeyRing::importKey( const PublicKey & key, bool trusted )
657  { _pimpl->importKey( key, trusted ); }
658 
659  void KeyRing::multiKeyImport( const Pathname & keyfile_r, bool trusted_r )
660  { _pimpl->multiKeyImport( keyfile_r, trusted_r ); }
661 
662  std::string KeyRing::readSignatureKeyId( const Pathname & signature )
663  { return _pimpl->readSignatureKeyId( signature ); }
664 
665  void KeyRing::deleteKey( const std::string & id, bool trusted )
666  { _pimpl->deleteKey( id, trusted ); }
667 
668  std::list<PublicKey> KeyRing::publicKeys()
669  { return _pimpl->publicKeys(); }
670 
671  std:: list<PublicKey> KeyRing::trustedPublicKeys()
672  { return _pimpl->trustedPublicKeys(); }
673 
674  std::list<PublicKeyData> KeyRing::publicKeyData()
675  { return _pimpl->publicKeyData(); }
676 
677  std::list<PublicKeyData> KeyRing::trustedPublicKeyData()
678  { return _pimpl->trustedPublicKeyData(); }
679 
680  bool KeyRing::verifyFileSignatureWorkflow( const Pathname & file, const std::string & filedesc, const Pathname & signature, bool & sigValid_r, const KeyContext & keycontext )
681  { return _pimpl->verifyFileSignatureWorkflow( file, filedesc, signature, sigValid_r, keycontext ); }
682 
683  bool KeyRing::verifyFileSignatureWorkflow( const Pathname & file, const std::string filedesc, const Pathname & signature, const KeyContext & keycontext )
684  { bool unused; return _pimpl->verifyFileSignatureWorkflow( file, filedesc, signature, unused, keycontext ); }
685 
686  bool KeyRing::verifyFileSignature( const Pathname & file, const Pathname & signature )
687  { return _pimpl->verifyFileSignature( file, signature ); }
688 
689  bool KeyRing::verifyFileTrustedSignature( const Pathname & file, const Pathname & signature )
690  { return _pimpl->verifyFileTrustedSignature( file, signature ); }
691 
692  void KeyRing::dumpPublicKey( const std::string & id, bool trusted, std::ostream & stream )
693  { _pimpl->dumpPublicKey( id, trusted, stream ); }
694 
696  { return _pimpl->exportPublicKey( keyData ); }
697 
699  { return _pimpl->exportTrustedPublicKey( keyData ); }
700 
701  bool KeyRing::isKeyTrusted( const std::string & id )
702  { return _pimpl->isKeyTrusted( id ); }
703 
704  bool KeyRing::isKeyKnown( const std::string & id )
705  { return _pimpl->isKeyKnown( id ); }
706 
708 } // namespace zypp
void importKey(const PublicKey &key, bool trusted=false)
imports a key from a file.
Definition: KeyRing.cc:656
const std::list< PublicKeyData > & publicKeyData()
Definition: KeyRing.cc:213
Interface to gettext.
#define MIL
Definition: Logger.h:64
PublicKey exportTrustedPublicKey(const PublicKeyData &keyData)
Export a trusted public key identified by its key data.
Definition: KeyRing.cc:698
PublicKey exportPublicKey(const PublicKeyData &keyData)
Definition: KeyRing.cc:219
const Pathname trustedKeyRing() const
Definition: KeyRing.cc:252
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
Definition: KeyRing.cc:216
void deleteKey(const std::string &id, bool trusted)
Definition: KeyRing.cc:296
PublicKey exportKey(const std::string &id, const Pathname &keyring)
Definition: KeyRing.cc:338
static bool error(const std::string &msg_r, const UserData &userData_r=UserData())
send error text
bool isKeyTrusted(const std::string &id)
Definition: KeyRing.cc:201
#define ZYPP_THROW(EXCPT)
Drops a logline and throws the Exception.
Definition: Exception.h:350
const std::list< PublicKeyData > & trustedPublicKeyData()
Definition: KeyRing.cc:211
Regular expression.
Definition: Regex.h:86
Pathname path() const
Definition: TmpPath.cc:146
This basically means, we knew the key, but it was not trusted.
Definition: KeyRing.h:61
PublicKey exportPublicKey(const PublicKeyData &keyData)
Export a public key identified by its key data.
Definition: KeyRing.cc:695
Class representing one GPG Public Keys data.
Definition: PublicKey.h:132
bool isKeyKnown(const std::string &id)
Definition: KeyRing.cc:203
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
Definition: KeyRing.cc:692
PublicKeyData publicKeyExists(const std::string &id, const Pathname &keyring)
Get PublicKeyData for ID (false if ID is not found).
Definition: KeyRing.cc:318
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
Definition: KeyRing.cc:291
std::list< PublicKey > trustedPublicKeys()
Get a list of trusted public keys in the keyring (incl.
Definition: KeyRing.cc:671
bool verifyFile(const Pathname &file, const Pathname &signature, const Pathname &keyring)
Definition: KeyRing.cc:607
virtual bool askUserToAcceptUnsignedFile(const std::string &file, const KeyContext &keycontext=KeyContext())
Definition: KeyRing.cc:65
KeyRing(const Pathname &baseTmpDir)
Default ctor.
Definition: KeyRing.cc:648
std::list< PublicKeyData > trustedPublicKeyData()
Get a list of trusted public key data in the keyring (key data only)
Definition: KeyRing.cc:677
bool verifyFileSignatureWorkflow(const Pathname &file, const std::string &filedesc, const Pathname &signature, bool &sigValid_r, const KeyContext &keycontext=KeyContext())
Follows a signature verification interacting with the user.
Definition: KeyRing.cc:680
#define for_(IT, BEG, END)
Convenient for-loops using iterator.
Definition: Easy.h:27
Convenient building of std::string with boost::format.
Definition: String.h:248
Provide a new empty temporary file and delete it when no longer needed.
Definition: TmpPath.h:126
virtual bool askUserToAcceptUnknownKey(const std::string &file, const std::string &id, const KeyContext &keycontext=KeyContext())
we DONT know the key, only its id, but we have never seen it, the difference with trust key is that i...
Definition: KeyRing.cc:78
CachedPublicKeyData cachedPublicKeyData
Functor returning the keyrings data (cached).
Definition: KeyRing.cc:266
#define ERR
Definition: Logger.h:66
std::string asString() const
Definition: String.h:258
Remember a files attributes to detect content changes.
Definition: WatchFile.h:49
virtual void infoVerify(const std::string &file_r, const PublicKeyData &keyData_r, const KeyContext &keycontext=KeyContext())
Informal callback showing the trusted key that will be used for verification.
Definition: KeyRing.cc:62
PublicKey exportTrustedPublicKey(const PublicKeyData &keyData)
Definition: KeyRing.cc:221
KeyTrust
User reply options for the askUserToTrustKey callback.
Definition: KeyRing.h:51
~KeyRing()
Dtor.
Definition: KeyRing.cc:652
Pathname path() const
File containig the ASCII armored key.
Definition: PublicKey.cc:582
static void setDefaultAccept(DefaultAccept value_r)
Set the active accept bits.
Definition: KeyRing.cc:56
Provide a new empty temporary directory and recursively delete it when no longer needed.
Definition: TmpPath.h:170
filesystem::TmpDir _trusted_tmp_dir
Definition: KeyRing.cc:256
bool verifyFileSignature(const Pathname &file, const Pathname &signature)
Definition: KeyRing.cc:226
Execute a program and give access to its io An object of this class encapsulates the execution of an ...
std::list< PublicKeyData > _data
Definition: KeyRing.cc:122
bool verifyFileSignatureWorkflow(const Pathname &file, const std::string &filedesc, const Pathname &signature, bool &sigValid_r, const KeyContext &keycontext=KeyContext())
Definition: KeyRing.cc:386
filesystem::TmpFile dumpPublicKeyToTmp(const std::string &id, const Pathname &keyring)
Definition: KeyRing.cc:375
const char * c_str() const
String representation.
Definition: Pathname.h:109
std::string fingerprint() const
Key fingerprint.
Definition: PublicKey.cc:228
#define WAR
Definition: Logger.h:65
IMPL_PTR_TYPE(Application)
KeyRing implementation.
Definition: KeyRing.cc:185
std::list< PublicKey > trustedPublicKeys()
Definition: KeyRing.cc:206
scoped_ptr< WatchFile > _keyringP
Definition: KeyRing.cc:126
bool startsWith(const C_Str &str_r, const C_Str &prefix_r)
alias for hasPrefix
Definition: String.h:1086
void importKey(const PublicKey &key, bool trusted=false)
Definition: KeyRing.cc:271
#define _(MSG)
Definition: Gettext.h:29
std::string receiveLine()
Read one line from the input stream.
Impl(const Pathname &baseTmpDir)
Definition: KeyRing.cc:187
bool isKeyKnown(const std::string &id)
true if the key id is knows, that means at least exist on the untrusted keyring
Definition: KeyRing.cc:704
Pathname _base_dir
Definition: KeyRing.cc:258
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
Initial import from RpmDb.
Definition: KeyRing.cc:659
const Pathname generalKeyRing() const
Definition: KeyRing.cc:250
int close()
Wait for the progamm to complete.
virtual KeyTrust askUserToAcceptKey(const PublicKey &key, const KeyContext &keycontext=KeyContext())
Ask user to trust and/or import the key to trusted keyring.
Definition: KeyRing.cc:69
scoped_ptr< WatchFile > _keyringK
Definition: KeyRing.cc:125
static DefaultAccept defaultAccept()
Get the active accept bits.
Definition: KeyRing.cc:53
RW_pointer< Impl > _pimpl
Pointer to implementation.
Definition: KeyRing.h:291
Regular expression match result.
Definition: Regex.h:145
Class representing one GPG Public Key (PublicKeyData + ASCII armored in a tempfile).
Definition: PublicKey.h:277
std::list< PublicKeyData > publicKeyData()
Get a list of public key data in the keyring (key data only)
Definition: KeyRing.cc:674
Base class for Exception.
Definition: Exception.h:143
callback::SendReport< DownloadProgressReport > * report
Definition: MediaCurl.cc:199
std::list< PublicKey > publicKeys()
Definition: KeyRing.cc:208
std::string id() const
Key ID.
Definition: PublicKey.cc:222
void deleteKey(const std::string &id, bool trusted=false)
removes a key from the keyring.
Definition: KeyRing.cc:665
bool verifyFileTrustedSignature(const Pathname &file, const Pathname &signature)
Definition: KeyRing.cc:689
bool verifyFileTrustedSignature(const Pathname &file, const Pathname &signature)
Definition: KeyRing.cc:228
std::string asUserHistory() const
A single (multiline) string composed of asUserString and historyAsString.
Definition: Exception.cc:91
bool regex_match(const std::string &s, smatch &matches, const regex &regex)
regex ZYPP_STR_REGEX regex ZYPP_STR_REGEX
Definition: Regex.h:70
const std::list< PublicKeyData > & publicKeyData(const Pathname &keyring)
Definition: KeyRing.cc:244
CacheMap _cacheMap
Definition: KeyRing.cc:175
#define GPG_BINARY
Definition: KeyRing.cc:40
bool isKeyTrusted(const std::string &id)
true if the key id is trusted
Definition: KeyRing.cc:701
Date created() const
Creation / last modification date (latest selfsig).
Definition: PublicKey.cc:231
Easy-to use interface to the ZYPP dependency resolver.
Definition: CodePitfalls.doc:1
std::string readSignatureKeyId(const Pathname &signature)
reads the public key id from a signature
Definition: KeyRing.cc:662
bool verifyFileSignature(const Pathname &file, const Pathname &signature)
Verifies a file against a signature, with no user interaction.
Definition: KeyRing.cc:686
std::string name() const
Definition: PublicKey.cc:591
std::string readSignatureKeyId(const Pathname &signature)
Definition: KeyRing.cc:569
virtual bool askUserToAcceptVerificationFailed(const std::string &file, const PublicKey &key, const KeyContext &keycontext=KeyContext())
The file filedesc is signed but the verification failed.
Definition: KeyRing.cc:81
std::list< PublicKey > publicKeys()
Get a list of public keys in the keyring (incl.
Definition: KeyRing.cc:668
filesystem::TmpDir _general_tmp_dir
Definition: KeyRing.cc:257