xCAT/xcat-dep
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 04:26:25 +00:00
Code Issues Projects Releases Wiki Activity

fix(build): reject expired/revoked signatures in the repo gate; drop unused import

Browse Source 
Review follow-up on the completeness+signature gate:
- repomd_observed_signer keyed off VALIDSIG, which gpg also emits for an EXPIRED or
  REVOKED key (and an expired signature) -- so a no-longer-trustworthy signature would
  PASS the gate. Reject EXPKEYSIG/REVKEYSIG/EXPSIG explicitly before accepting VALIDSIG.
- drop the now-unused have_rpm import (its only caller, assert_required_deps, was replaced
  by verify_target_repo).
prove t/mockbuild-all.t: 68/68.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-08-12 16:43:16 -03:00
parent 25dfc3957a
commit bebc390907
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mockbuild-all.pl
+7 -3
View File
@@ -13,7 +13,7 @@ use Parallel::ForkManager;
use POSIX qw(strftime);
use FindBin qw($RealBin);
use lib $RealBin;
use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs have_rpm
use MockBuildUtils qw(sh_quote print_step version_matches required_pkgs
read_manifest verify_repo_packages verify_repo_signature
rpm_version rpm_release rpm_sigmd5 restamp_release_line
cross_copy_genesis finalize_xcat_dep bump_dep_release_suffix);
@@ -1128,8 +1128,12 @@ sub repomd_observed_signer {
my ($asc, $file, $home) = @_;
return '' unless -f $asc && -f $file;
my $h = ($home ne '') ? ' --homedir ' . sh_quote($home) : '';
my $out = `gpg$h --status-fd=1 --verify ${\ sh_quote($asc)} ${\ sh_quote($file)} 2>/dev/null`;
for my $line (split /\n/, $out // '') {
my $out = `gpg$h --status-fd=1 --verify ${\ sh_quote($asc)} ${\ sh_quote($file)} 2>/dev/null` // '';
# An EXPIRED or REVOKED key, or an expired signature, still emits VALIDSIG -- reject those
# explicitly so a no-longer-trustworthy signature is a problem, not a pass. A fully-good signature
# emits GOODSIG; the degraded cases emit EXPKEYSIG/REVKEYSIG/EXPSIG instead.
return '' if $out =~ /^\[GNUPG:\]\s+(?:EXPKEYSIG|REVKEYSIG|EXPSIG)\b/m;
for my $line (split /\n/, $out) {
# VALIDSIG <signing-fpr> <dates...> <primary-key-fpr>; the trailing field is the primary fpr.
if ($line =~ /^\[GNUPG:\]\s+VALIDSIG\s+(.*\S)\s*$/) {
my @f = split ' ', $1;