17 #include <zypp-common/PublicKey.h> 21 #include <zypp-core/zyppng/pipelines/Expected> 23 #include <zypp/ng/Context> 25 #include <zypp/ng/UserRequest> 29 template <
class Executor,
class OpType>
48 using zyppng::operators::operator|;
65 key = zypp::PublicKey( myKey );
71 if ( !key.isValid() ) {
72 ERR <<
"Key [" <<
_keyId <<
"] from cache: " << cacheDir <<
" is not valid" << std::endl;
76 MIL <<
"Key [" <<
_keyId <<
"] " << key.name() <<
" loaded from cache" << std::endl;
84 MIL <<
"User wants to import key [" <<
_keyId <<
"] " << key.name() <<
" from cache" << std::endl;
86 _context->keyRing()->importKey( key,
true );
87 }
catch (
const zypp::KeyRingException &e ) {
117 template <
class Executor,
class OpType>
118 struct VerifyFileSignatureLogic :
public LogicBase<Executor, OpType>
132 struct FoundKeyData {
138 MaybeAsyncRef<FoundKeyData> findKey (
const std::string &
id ) {
140 using zyppng::operators::operator|;
146 zypp::PublicKeyData trustedKeyData(
_keyRing->pimpl().publicKeyExists(
id,
_keyRing->pimpl().trustedKeyRing() ) );
147 if ( trustedKeyData )
149 MIL <<
"Key is trusted: " << trustedKeyData << std::endl;
153 zypp::PublicKeyData generalKeyData(
_keyRing->pimpl().publicKeyExists(
id,
_keyRing->pimpl().generalKeyRing() ) );
154 if ( generalKeyData )
164 if ( trustedKeyData.fingerprint() == generalKeyData.fingerprint()
165 && trustedKeyData.created() < generalKeyData.created() )
167 MIL <<
"Key was updated. Saving new version into trusted keyring: " << generalKeyData << std::endl;
169 trustedKeyData =
_keyRing->pimpl().publicKeyExists(
id,
_keyRing->pimpl().trustedKeyRing() );
177 zypp::PublicKeyData generalKeyData(
_keyRing->pimpl().publicKeyExists(
id,
_keyRing->pimpl().generalKeyRing() ) );
178 if ( generalKeyData )
180 zypp::PublicKey key(
_keyRing->pimpl().exportKey( generalKeyData,
_keyRing->pimpl().generalKeyRing() ) );
181 MIL <<
"Key [" <<
id <<
"] " << key.name() <<
" is not trusted" << std::endl;
190 MIL <<
"User wants to trust key [" <<
id <<
"] " << key.name() << std::endl;
194 MIL <<
"User wants to import key [" <<
id <<
"] " << key.name() << std::endl;
196 whichKeyring =
_keyRing->pimpl().trustedKeyRing();
199 whichKeyring =
_keyRing->pimpl().generalKeyRing();
201 return makeReadyResult(FoundKeyData { std::move(generalKeyData), std::move(whichKeyring),
true });
205 MIL <<
"User does not want to trust key [" <<
id <<
"] " << key.name() << std::endl;
213 | [
this,
id](
bool success ) {
217 return FoundKeyData{
_keyRing->pimpl().publicKeyExists(
id,
_keyRing->pimpl().trustedKeyRing() ),
_keyRing->pimpl().trustedKeyRing(),
true };
232 MIL <<
"Going to verify signature for " << filedesc <<
" ( " << file <<
" ) with " << signature << std::endl;
238 MIL <<
"askUserToAcceptUnsignedFile: " << res << std::endl;
247 std::list<zypp::PublicKeyData> buddies;
249 if ( not zypp::PublicKeyData::isSafeKeyId( sid ) ) {
250 WAR <<
"buddy " << sid <<
": key id is too short to safely identify a gpg key. Skipping it." << std::endl;
253 if (
_keyRing->pimpl().trustedPublicKeyExists( sid ) ) {
254 MIL <<
"buddy " << sid <<
": already in trusted key ring. Not needed." << std::endl;
257 auto pk =
_keyRing->pimpl().publicKeyExists( sid );
259 WAR <<
"buddy " << sid <<
": not available in the public key ring. Skipping it." << std::endl;
262 if ( pk.providesKey(
id) ) {
263 MIL <<
"buddy " << sid <<
": is the signing key. Handled separately." << std::endl;
266 MIL <<
"buddy " << sid <<
": candidate for auto import. Remeber it." << std::endl;
267 buddies.push_back( pk );
270 using zyppng::operators::operator|;
271 return findKey(
id ) | [
this, id, buddies=std::move(buddies)]( FoundKeyData res ) {
278 if ( res._foundKey ) {
282 return makeReturn(
false);
287 if (
_keyRing->pimpl().verifyFile( file, signature, res._whichKeyRing ) )
292 MIL <<
"Validated with trusted key: importing buddy list..." << std::endl;
293 _keyringReport.reportAutoImportKey( buddies, res._foundKey, keyContext );
294 for (
const auto & kd : buddies ) {
302 bool userAnswer =
_keyringReport.askUserToAcceptVerificationFailed( filedesc,
_keyRing->pimpl().exportKey( res._foundKey, res._whichKeyRing ), keyContext );
303 MIL <<
"askUserToAcceptVerificationFailed: " << userAnswer << std::endl;
304 return makeReturn(userAnswer);
308 MIL <<
"File [" << file <<
"] ( " << filedesc <<
" ) signed with unknown key [" <<
id <<
"]" << std::endl;
310 MIL <<
"askUserToAcceptUnknownKey: " << res << std::endl;
311 return makeReturn(res);
314 return makeReturn(
false);
325 inline std::pair<bool, zypp::keyring::VerifyFileContext> makeReturn(
bool res ){
334 auto kr = zyppContext->keyRing();
340 auto kr = zyppContext->keyRing();
bool fileValidated() const
Whether the signature was actually successfully verified.
ZyppContextRefType _context
zypp::PublicKeyData _foundKey
const std::string & signatureId() const
The id of the gpg key which signed the file.
zypp::keyring::VerifyFileContext _verifyContext
This basically means, we knew the key, but it was not trusted.
Pathname pubkeyCachePath() const
Path where the pubkey caches.
zypp::Pathname _whichKeyRing
bool provideAndImportKeyFromRepository(SyncContextRef ctx, std::string id_r, zypp::RepoInfo info_r)
Try to find the id in key cache or repository specified in info.
What is known about a repository.
I/O context for KeyRing::verifyFileSignatureWorkflow.
typename ProvideType::Res ProvideRes
std::pair< bool, zypp::keyring::VerifyFileContext > verifyFileSignature(SyncContextRef zyppContext, zypp::keyring::VerifyFileContext &&context_r)
Follows a signature verification interacting with the user.
zypp::KeyRing_Ptr KeyRingRef
const KeyContext & keyContext() const
KeyContext passed to callbacks
bool signatureIdTrusted() const
Whether the SignatureId is in the trusted keyring (not temp.
void resetResults()
Reset all result values to safe defaults.
Pathname repoManagerRoot() const
The RepoManager root directory.
KeyTrust
User reply options for the askUserToTrustKey callback.
static std::enable_if_t< detail::is_async_op_v< FOpType >, AsyncOpRef< Result > > run(Args &&...args)
const Pathname & signature() const
Detached signature or empty.
bool isExist() const
Return whether valid stat info exists.
Interim helper class to collect global options and settings.
ImportKeyFromRepoLogic(ZyppContextRefType context, std::string &&keyId, zypp::RepoInfo &&info)
typename ProvideType::MediaHandle MediaHandle
const Pathname & file() const
File to verify.
KeyRingReportHelper< ZyppContextRefType > _keyringReport
const BuddyKeys & buddyKeys() const
auto makeReadyResult(T &&res)
#define ZYPP_CAUGHT(EXCPT)
Drops a logline telling the Exception was caught (in order to handle it).
const RepoInfo repoInfo() const
std::shared_ptr< AsyncOp< T > > AsyncOpRef
typename ZyppContextType::ProvideType ProvideType
Base class for Exception.
bool empty() const
Is the context unknown?
zypp::Pathname provideKey(SyncContextRef ctx, zypp::RepoInfo info, std::string keyID_r, zypp::Pathname targetDirectory_r)
remove_smart_ptr_t< ZyppContextRefType > ZyppContextType
Wrapper class for ::stat/::lstat.
MaybeAsyncContextRef< OpType > ZyppContextRefType
std::conditional_t< isAsync, AsyncOpRef< Type >, Type > MaybeAsyncRef
bool fileAccepted() const
May return true due to user interaction or global defaults even if the signature was not actually ver...
std::conditional_t< detail::is_async_op_v< OpType >, ContextRef, SyncContextRef > MaybeAsyncContextRef
ZYPP_ENABLE_LOGIC_BASE(Executor, OpType)
void setRepoInfo(const RepoInfo &repoinfo)
ZyppContextRefType _zyppContext
typename remove_smart_ptr< T >::type remove_smart_ptr_t
std::string shortFile() const
Short name for file (default: basename).
MaybeAsyncRef< bool > execute()