00001
00005 #include "system.h"
00006
00007 #include "rpmio_internal.h"
00008 #include <rpmlib.h>
00009 #include <rpmmacro.h>
00010 #include "rpmdb.h"
00011
00012 #include "rpmts.h"
00013
00014 #include "misc.h"
00015 #include "legacy.h"
00016 #include "rpmlead.h"
00017 #include "signature.h"
00018 #include "header_internal.h"
00019 #include "debug.h"
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029 #if !defined(__GLIBC__)
00030 char ** environ = NULL;
00031 #endif
00032
00033 int rpmLookupSignatureType(int action)
00034 {
00035
00036 static int disabled = 0;
00037 int rc = 0;
00038
00039 switch (action) {
00040 case RPMLOOKUPSIG_DISABLE:
00041 disabled = -2;
00042 break;
00043 case RPMLOOKUPSIG_ENABLE:
00044 disabled = 0;
00045
00046 case RPMLOOKUPSIG_QUERY:
00047 if (disabled)
00048 break;
00049
00050 { const char *name = rpmExpand("%{?_signature}", NULL);
00051 if (!(name && *name != '\0'))
00052 rc = 0;
00053 else if (!xstrcasecmp(name, "none"))
00054 rc = 0;
00055 else if (!xstrcasecmp(name, "pgp"))
00056 rc = RPMSIGTAG_PGP;
00057 else if (!xstrcasecmp(name, "pgp5"))
00058 rc = RPMSIGTAG_PGP;
00059 else if (!xstrcasecmp(name, "gpg"))
00060 rc = RPMSIGTAG_GPG;
00061 else
00062 rc = -1;
00063 name = _free(name);
00064 } break;
00065
00066 }
00067 return rc;
00068 }
00069
00070
00071
00072
00073 const char * rpmDetectPGPVersion(pgpVersion * pgpVer)
00074 {
00075
00076
00077
00078
00079 static pgpVersion saved_pgp_version = PGP_UNKNOWN;
00080 const char *pgpbin = rpmGetPath("%{?_pgpbin}", NULL);
00081
00082 if (saved_pgp_version == PGP_UNKNOWN) {
00083 char *pgpvbin;
00084 struct stat st;
00085
00086
00087 if (!(pgpbin && pgpbin[0] != '\0')) {
00088 pgpbin = _free(pgpbin);
00089 saved_pgp_version = -1;
00090 return NULL;
00091 }
00092
00093
00094 pgpvbin = (char *)alloca(strlen(pgpbin) + sizeof("v"));
00095 (void)stpcpy(stpcpy(pgpvbin, pgpbin), "v");
00096
00097
00098 if (stat(pgpvbin, &st) == 0)
00099 saved_pgp_version = PGP_5;
00100 else if (stat(pgpbin, &st) == 0)
00101 saved_pgp_version = PGP_2;
00102 else
00103 saved_pgp_version = PGP_NOTDETECTED;
00104 }
00105
00106
00107 if (pgpVer && pgpbin)
00108 *pgpVer = saved_pgp_version;
00109
00110 return pgpbin;
00111 }
00112
00122 static inline rpmRC printSize(FD_t fd, int siglen, int pad, int datalen)
00123
00124
00125 {
00126 struct stat st;
00127
00128 if (fstat(Fileno(fd), &st) < 0)
00129 return RPMRC_FAIL;
00130
00131
00132 rpmMessage(RPMMESS_DEBUG,
00133 _("Expected size: %12d = lead(%d)+sigs(%d)+pad(%d)+data(%d)\n"),
00134 (int)sizeof(struct rpmlead)+siglen+pad+datalen,
00135 (int)sizeof(struct rpmlead), siglen, pad, datalen);
00136
00137 rpmMessage(RPMMESS_DEBUG,
00138 _(" Actual size: %12d\n"), (int)st.st_size);
00139
00140 return RPMRC_OK;
00141 }
00142
00143
00144 static unsigned char header_magic[8] = {
00145 0x8e, 0xad, 0xe8, 0x01, 0x00, 0x00, 0x00, 0x00
00146 };
00147
00148 rpmRC rpmReadSignature(FD_t fd, Header * sighp, sigType sig_type,
00149 const char ** msg)
00150 {
00151 char buf[BUFSIZ];
00152 int_32 block[4];
00153 int_32 il;
00154 int_32 dl;
00155 int_32 * ei = NULL;
00156 entryInfo pe;
00157 size_t nb;
00158 int_32 ril = 0;
00159 indexEntry entry = memset(alloca(sizeof(*entry)), 0, sizeof(*entry));
00160 entryInfo info = memset(alloca(sizeof(*info)), 0, sizeof(*info));
00161 unsigned char * dataStart;
00162 unsigned char * dataEnd = NULL;
00163 Header sigh = NULL;
00164 rpmRC rc = RPMRC_FAIL;
00165 int xx;
00166 int i;
00167
00168
00169 if (sighp)
00170 *sighp = NULL;
00171
00172 buf[0] = '\0';
00173
00174
00175 if (sig_type != RPMSIGTYPE_HEADERSIG)
00176 goto exit;
00177
00178 memset(block, 0, sizeof(block));
00179 if ((xx = timedRead(fd, (char *)block, sizeof(block))) != sizeof(block)) {
00180 (void) snprintf(buf, sizeof(buf),
00181 _("sigh size(%d): BAD, read returned %d\n"), (int)sizeof(block), xx);
00182 goto exit;
00183 }
00184 if (memcmp(block, header_magic, sizeof(header_magic))) {
00185 (void) snprintf(buf, sizeof(buf),
00186 _("sigh magic: BAD\n"));
00187 goto exit;
00188 }
00189
00190 il = ntohl(block[2]);
00191
00192 if (il < 0 || il > 32) {
00193 (void) snprintf(buf, sizeof(buf),
00194 _("sigh tags: BAD, no. of tags(%d) out of range\n"), il);
00195 goto exit;
00196 }
00197
00198 dl = ntohl(block[3]);
00199
00200 if (dl < 0 || dl > 8192) {
00201 (void) snprintf(buf, sizeof(buf),
00202 _("sigh data: BAD, no. of bytes(%d) out of range\n"), dl);
00203 goto exit;
00204 }
00205
00206
00207 nb = (il * sizeof(struct entryInfo_s)) + dl;
00208
00209 ei = xmalloc(sizeof(il) + sizeof(dl) + nb);
00210
00211 ei[0] = block[2];
00212 ei[1] = block[3];
00213 pe = (entryInfo) &ei[2];
00214
00215 dataStart = (unsigned char *) (pe + il);
00216 if ((xx = timedRead(fd, (char *)pe, nb)) != nb) {
00217 (void) snprintf(buf, sizeof(buf),
00218 _("sigh blob(%d): BAD, read returned %d\n"), (int)nb, xx);
00219 goto exit;
00220 }
00221
00222
00223 xx = headerVerifyInfo(1, dl, pe, &entry->info, 0);
00224 if (xx != -1) {
00225 (void) snprintf(buf, sizeof(buf),
00226 _("tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
00227 0, entry->info.tag, entry->info.type,
00228 entry->info.offset, entry->info.count);
00229 goto exit;
00230 }
00231
00232
00233 if (entry->info.tag == RPMTAG_HEADERSIGNATURES) {
00234
00235 if (!(entry->info.type == REGION_TAG_TYPE &&
00236 entry->info.count == REGION_TAG_COUNT)) {
00237 (void) snprintf(buf, sizeof(buf),
00238 _("region tag: BAD, tag %d type %d offset %d count %d\n"),
00239 entry->info.tag, entry->info.type,
00240 entry->info.offset, entry->info.count);
00241 goto exit;
00242 }
00243
00244 if (entry->info.offset + REGION_TAG_COUNT > dl) {
00245 (void) snprintf(buf, sizeof(buf),
00246 _("region offset: BAD, tag %d type %d offset %d count %d\n"),
00247 entry->info.tag, entry->info.type,
00248 entry->info.offset, entry->info.count);
00249 goto exit;
00250 }
00251
00252
00253 dataEnd = dataStart + entry->info.offset;
00254
00255
00256 (void) memcpy(info, dataEnd, REGION_TAG_COUNT);
00257
00258 dataEnd += REGION_TAG_COUNT;
00259
00260 xx = headerVerifyInfo(1, il * sizeof(*pe), info, &entry->info, 1);
00261 if (xx != -1 ||
00262 !(entry->info.tag == RPMTAG_HEADERSIGNATURES
00263 && entry->info.type == REGION_TAG_TYPE
00264 && entry->info.count == REGION_TAG_COUNT))
00265 {
00266 (void) snprintf(buf, sizeof(buf),
00267 _("region trailer: BAD, tag %d type %d offset %d count %d\n"),
00268 entry->info.tag, entry->info.type,
00269 entry->info.offset, entry->info.count);
00270 goto exit;
00271 }
00272
00273
00274 memset(info, 0, sizeof(*info));
00275
00276
00277
00278 ril = entry->info.offset/sizeof(*pe);
00279 if ((entry->info.offset % sizeof(*pe)) || ril > il) {
00280 (void) snprintf(buf, sizeof(buf),
00281 _("region size: BAD, ril(%d) > il(%d)\n"), ril, il);
00282 goto exit;
00283 }
00284 }
00285
00286
00287
00288 memset(info, 0, sizeof(*info));
00289
00290 for (i = 1; i < il; i++) {
00291 xx = headerVerifyInfo(1, dl, pe+i, &entry->info, 0);
00292 if (xx != -1) {
00293 (void) snprintf(buf, sizeof(buf),
00294 _("sigh tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
00295 i, entry->info.tag, entry->info.type,
00296 entry->info.offset, entry->info.count);
00297 goto exit;
00298 }
00299 }
00300
00301
00302 sigh = headerLoad(ei);
00303 if (sigh == NULL) {
00304 (void) snprintf(buf, sizeof(buf), _("sigh load: BAD\n"));
00305 goto exit;
00306 }
00307 sigh->flags |= HEADERFLAG_ALLOCATED;
00308
00309 { int sigSize = headerSizeof(sigh, HEADER_MAGIC_YES);
00310 int pad = (8 - (sigSize % 8)) % 8;
00311 int_32 * archSize = NULL;
00312
00313
00314 if (pad && (xx = timedRead(fd, (char *)block, pad)) != pad) {
00315 (void) snprintf(buf, sizeof(buf),
00316 _("sigh pad(%d): BAD, read %d bytes\n"), pad, xx);
00317 goto exit;
00318 }
00319
00320
00321 if (headerGetEntry(sigh, RPMSIGTAG_SIZE, NULL,(void **)&archSize, NULL))
00322 rc = printSize(fd, sigSize, pad, *archSize);
00323 }
00324
00325 exit:
00326
00327 if (sighp && sigh && rc == RPMRC_OK)
00328 *sighp = headerLink(sigh);
00329 sigh = headerFree(sigh);
00330
00331 if (msg != NULL) {
00332 buf[sizeof(buf)-1] = '\0';
00333 *msg = xstrdup(buf);
00334 }
00335
00336
00337 return rc;
00338 }
00339
00340 int rpmWriteSignature(FD_t fd, Header h)
00341 {
00342 static byte buf[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
00343 int sigSize, pad;
00344 int rc;
00345
00346 rc = headerWrite(fd, h, HEADER_MAGIC_YES);
00347 if (rc)
00348 return rc;
00349
00350 sigSize = headerSizeof(h, HEADER_MAGIC_YES);
00351 pad = (8 - (sigSize % 8)) % 8;
00352 if (pad) {
00353
00354 if (Fwrite(buf, sizeof(buf[0]), pad, fd) != pad)
00355 rc = 1;
00356
00357 }
00358 rpmMessage(RPMMESS_DEBUG, _("Signature: size(%d)+pad(%d)\n"), sigSize, pad);
00359 return rc;
00360 }
00361
00362 Header rpmNewSignature(void)
00363 {
00364 Header h = headerNew();
00365 return h;
00366 }
00367
00368 Header rpmFreeSignature(Header h)
00369 {
00370 return headerFree(h);
00371 }
00372
00381 static int makePGPSignature(const char * file, byte ** pkt,
00382 int_32 * pktlen, const char * passPhrase)
00383
00384
00385
00386
00387 {
00388 char * sigfile = alloca(1024);
00389 int pid, status;
00390 int inpipe[2];
00391 struct stat st;
00392 const char * cmd;
00393 char *const *av;
00394 int rc;
00395
00396
00397 (void) stpcpy( stpcpy(sigfile, file), ".sig");
00398
00399
00400 addMacro(NULL, "__plaintext_filename", NULL, file, -1);
00401 addMacro(NULL, "__signature_filename", NULL, sigfile, -1);
00402
00403 inpipe[0] = inpipe[1] = 0;
00404
00405 (void) pipe(inpipe);
00406
00407
00408 if (!(pid = fork())) {
00409 const char *pgp_path = rpmExpand("%{?_pgp_path}", NULL);
00410 const char *path;
00411 pgpVersion pgpVer;
00412
00413 (void) close(STDIN_FILENO);
00414 (void) dup2(inpipe[0], 3);
00415 (void) close(inpipe[1]);
00416
00417 (void) dosetenv("PGPPASSFD", "3", 1);
00418
00419 if (pgp_path && *pgp_path != '\0')
00420 (void) dosetenv("PGPPATH", pgp_path, 1);
00421
00422
00423
00424
00425 unsetenv("MALLOC_CHECK_");
00426 #if defined(__GLIBC__)
00427
00431 {
00432 char* bypassVar = (char*) malloc(1024*sizeof(char));
00433 if (bypassVar != NULL)
00434 {
00435 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00436 bypassVar[1023] = '\0';
00437 if (getenv(bypassVar) != NULL)
00438 {
00439 char* bypassVal = (char*) malloc(1024*sizeof(char));
00440 if (bypassVal != NULL)
00441 {
00442 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00443 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00444 unsetenv(bypassVar);
00445 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00446 bypassVar[1023] = '\0';
00447 putenv(bypassVar);
00448 free(bypassVal);
00449 }
00450 else
00451 {
00452 free(bypassVar);
00453 }
00454 }
00455 }
00456 }
00457 #endif
00458 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
00459 switch(pgpVer) {
00460 case PGP_2:
00461 cmd = rpmExpand("%{?__pgp_sign_cmd}", NULL);
00462 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00463
00464 if (!rc)
00465 rc = execve(av[0], av+1, environ);
00466
00467 break;
00468 case PGP_5:
00469 cmd = rpmExpand("%{?__pgp5_sign_cmd}", NULL);
00470 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00471
00472 if (!rc)
00473 rc = execve(av[0], av+1, environ);
00474
00475 break;
00476 case PGP_UNKNOWN:
00477 case PGP_NOTDETECTED:
00478 errno = ENOENT;
00479 break;
00480 }
00481 }
00482 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "pgp",
00483 strerror(errno));
00484 _exit(RPMERR_EXEC);
00485 }
00486
00487 delMacro(NULL, "__plaintext_filename");
00488 delMacro(NULL, "__signature_filename");
00489
00490 (void) close(inpipe[0]);
00491 if (passPhrase)
00492 (void) write(inpipe[1], passPhrase, strlen(passPhrase));
00493 (void) write(inpipe[1], "\n", 1);
00494 (void) close(inpipe[1]);
00495
00496 (void)waitpid(pid, &status, 0);
00497 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
00498 rpmError(RPMERR_SIGGEN, _("pgp failed\n"));
00499 return 1;
00500 }
00501
00502 if (stat(sigfile, &st)) {
00503
00504 if (sigfile) (void) unlink(sigfile);
00505 rpmError(RPMERR_SIGGEN, _("pgp failed to write signature\n"));
00506 return 1;
00507 }
00508
00509
00510 *pktlen = st.st_size;
00511 rpmMessage(RPMMESS_DEBUG, _("PGP sig size: %d\n"), *pktlen);
00512 *pkt = xmalloc(*pktlen);
00513
00514
00515
00516 { FD_t fd;
00517
00518 rc = 0;
00519 fd = Fopen(sigfile, "r.fdio");
00520 if (fd != NULL && !Ferror(fd)) {
00521 rc = timedRead(fd, *pkt, *pktlen);
00522 if (sigfile) (void) unlink(sigfile);
00523 (void) Fclose(fd);
00524 }
00525 if (rc != *pktlen) {
00526
00527 *pkt = _free(*pkt);
00528
00529 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
00530 return 1;
00531 }
00532 }
00533
00534 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of PGP sig\n"), *pktlen);
00535
00536
00537 return 0;
00538 }
00539
00548 static int makeGPGSignature(const char * file, byte ** pkt,
00549 int_32 * pktlen, const char * passPhrase)
00550
00551
00552
00553
00554 {
00555 char * sigfile = alloca(1024);
00556 int pid, status;
00557 int inpipe[2];
00558 FILE * fpipe;
00559 struct stat st;
00560 const char * cmd;
00561 char *const *av;
00562 int rc;
00563
00564
00565 (void) stpcpy( stpcpy(sigfile, file), ".sig");
00566
00567
00568 addMacro(NULL, "__plaintext_filename", NULL, file, -1);
00569 addMacro(NULL, "__signature_filename", NULL, sigfile, -1);
00570
00571 inpipe[0] = inpipe[1] = 0;
00572
00573 (void) pipe(inpipe);
00574
00575
00576 if (!(pid = fork())) {
00577 const char *gpg_path = rpmExpand("%{?_gpg_path}", NULL);
00578
00579 (void) close(STDIN_FILENO);
00580 (void) dup2(inpipe[0], 3);
00581 (void) close(inpipe[1]);
00582
00583
00584 if (gpg_path && *gpg_path != '\0')
00585 (void) dosetenv("GNUPGHOME", gpg_path, 1);
00586
00587
00588 unsetenv("MALLOC_CHECK_");
00589
00590 #if defined(__GLIBC__)
00591
00595 {
00596 char* bypassVar = (char*) malloc(1024*sizeof(char));
00597 if (bypassVar != NULL)
00598 {
00599 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00600 bypassVar[1023] = '\0';
00601 if (getenv(bypassVar) != NULL)
00602 {
00603 char* bypassVal = (char*) malloc(1024*sizeof(char));
00604 if (bypassVal != NULL)
00605 {
00606 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00607 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00608 unsetenv(bypassVar);
00609 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00610 bypassVar[1023] = '\0';
00611 putenv(bypassVar);
00612 free(bypassVal);
00613 }
00614 else
00615 {
00616 free(bypassVar);
00617 }
00618 }
00619 }
00620 }
00621 #endif
00622 cmd = rpmExpand("%{?__gpg_sign_cmd}", NULL);
00623 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00624
00625 if (!rc)
00626 rc = execve(av[0], av+1, environ);
00627
00628
00629 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "gpg",
00630 strerror(errno));
00631 _exit(RPMERR_EXEC);
00632 }
00633
00634 delMacro(NULL, "__plaintext_filename");
00635 delMacro(NULL, "__signature_filename");
00636
00637 fpipe = fdopen(inpipe[1], "w");
00638 (void) close(inpipe[0]);
00639 if (fpipe) {
00640 fprintf(fpipe, "%s\n", (passPhrase ? passPhrase : ""));
00641 (void) fclose(fpipe);
00642 }
00643
00644 (void) waitpid(pid, &status, 0);
00645 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
00646 rpmError(RPMERR_SIGGEN, _("gpg failed\n"));
00647 return 1;
00648 }
00649
00650 if (stat(sigfile, &st)) {
00651
00652 if (sigfile) (void) unlink(sigfile);
00653 rpmError(RPMERR_SIGGEN, _("gpg failed to write signature\n"));
00654 return 1;
00655 }
00656
00657
00658 *pktlen = st.st_size;
00659 rpmMessage(RPMMESS_DEBUG, _("GPG sig size: %d\n"), *pktlen);
00660 *pkt = xmalloc(*pktlen);
00661
00662
00663
00664 { FD_t fd;
00665
00666 rc = 0;
00667 fd = Fopen(sigfile, "r.fdio");
00668 if (fd != NULL && !Ferror(fd)) {
00669 rc = timedRead(fd, *pkt, *pktlen);
00670 if (sigfile) (void) unlink(sigfile);
00671 (void) Fclose(fd);
00672 }
00673 if (rc != *pktlen) {
00674
00675 *pkt = _free(*pkt);
00676
00677 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
00678 return 1;
00679 }
00680 }
00681
00682 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of GPG sig\n"), *pktlen);
00683
00684
00685 return 0;
00686 }
00687
00696 static int makeHDRSignature(Header sig, const char * file, int_32 sigTag,
00697 const char * passPhrase)
00698
00699
00700 {
00701 Header h = NULL;
00702 FD_t fd = NULL;
00703 byte * pkt;
00704 int_32 pktlen;
00705 const char * fn = NULL;
00706 const char * SHA1 = NULL;
00707 int ret = -1;
00708
00709 switch (sigTag) {
00710 case RPMSIGTAG_SIZE:
00711 case RPMSIGTAG_MD5:
00712 case RPMSIGTAG_PGP5:
00713 case RPMSIGTAG_PGP:
00714 case RPMSIGTAG_GPG:
00715 goto exit;
00716 break;
00717 case RPMSIGTAG_SHA1:
00718 fd = Fopen(file, "r.fdio");
00719 if (fd == NULL || Ferror(fd))
00720 goto exit;
00721 h = headerRead(fd, HEADER_MAGIC_YES);
00722 if (h == NULL)
00723 goto exit;
00724 (void) Fclose(fd); fd = NULL;
00725
00726 if (headerIsEntry(h, RPMTAG_HEADERIMMUTABLE)) {
00727 DIGEST_CTX ctx;
00728 void * uh;
00729 int_32 uht, uhc;
00730
00731 if (!headerGetEntry(h, RPMTAG_HEADERIMMUTABLE, &uht, &uh, &uhc)
00732 || uh == NULL)
00733 {
00734 h = headerFree(h);
00735 goto exit;
00736 }
00737 ctx = rpmDigestInit(PGPHASHALGO_SHA1, RPMDIGEST_NONE);
00738 (void) rpmDigestUpdate(ctx, header_magic, sizeof(header_magic));
00739 (void) rpmDigestUpdate(ctx, uh, uhc);
00740 (void) rpmDigestFinal(ctx, (void **)&SHA1, NULL, 1);
00741 uh = headerFreeData(uh, uht);
00742 }
00743 h = headerFree(h);
00744
00745 if (SHA1 == NULL)
00746 goto exit;
00747 if (!headerAddEntry(sig, RPMSIGTAG_SHA1, RPM_STRING_TYPE, SHA1, 1))
00748 goto exit;
00749 ret = 0;
00750 break;
00751 case RPMSIGTAG_DSA:
00752 fd = Fopen(file, "r.fdio");
00753 if (fd == NULL || Ferror(fd))
00754 goto exit;
00755 h = headerRead(fd, HEADER_MAGIC_YES);
00756 if (h == NULL)
00757 goto exit;
00758 (void) Fclose(fd); fd = NULL;
00759 if (makeTempFile(NULL, &fn, &fd))
00760 goto exit;
00761 if (headerWrite(fd, h, HEADER_MAGIC_YES))
00762 goto exit;
00763 (void) Fclose(fd); fd = NULL;
00764 if (makeGPGSignature(fn, &pkt, &pktlen, passPhrase)
00765 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00766 goto exit;
00767 ret = 0;
00768 break;
00769 case RPMSIGTAG_RSA:
00770 fd = Fopen(file, "r.fdio");
00771 if (fd == NULL || Ferror(fd))
00772 goto exit;
00773 h = headerRead(fd, HEADER_MAGIC_YES);
00774 if (h == NULL)
00775 goto exit;
00776 (void) Fclose(fd); fd = NULL;
00777 if (makeTempFile(NULL, &fn, &fd))
00778 goto exit;
00779 if (headerWrite(fd, h, HEADER_MAGIC_YES))
00780 goto exit;
00781 (void) Fclose(fd); fd = NULL;
00782 if (makePGPSignature(fn, &pkt, &pktlen, passPhrase)
00783 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00784 goto exit;
00785 ret = 0;
00786 break;
00787 }
00788
00789 exit:
00790 if (fn) {
00791 (void) unlink(fn);
00792 fn = _free(fn);
00793 }
00794 SHA1 = _free(SHA1);
00795 h = headerFree(h);
00796 if (fd != NULL) (void) Fclose(fd);
00797 return ret;
00798 }
00799
00800 int rpmAddSignature(Header sig, const char * file, int_32 sigTag,
00801 const char * passPhrase)
00802 {
00803 struct stat st;
00804 byte * pkt;
00805 int_32 pktlen;
00806 int ret = -1;
00807
00808 switch (sigTag) {
00809 case RPMSIGTAG_SIZE:
00810 if (stat(file, &st) != 0)
00811 break;
00812 pktlen = st.st_size;
00813 if (!headerAddEntry(sig, sigTag, RPM_INT32_TYPE, &pktlen, 1))
00814 break;
00815 ret = 0;
00816 break;
00817 case RPMSIGTAG_MD5:
00818 pktlen = 16;
00819 pkt = memset(alloca(pktlen), 0, pktlen);
00820 if (domd5(file, pkt, 0, NULL)
00821 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00822 break;
00823 ret = 0;
00824 break;
00825 case RPMSIGTAG_PGP5:
00826 case RPMSIGTAG_PGP:
00827 if (makePGPSignature(file, &pkt, &pktlen, passPhrase)
00828 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00829 break;
00830 #ifdef NOTYET
00831
00832 ret = makeHDRSignature(sig, file, RPMSIGTAG_RSA, passPhrase);
00833 #endif
00834 ret = 0;
00835 break;
00836 case RPMSIGTAG_GPG:
00837 if (makeGPGSignature(file, &pkt, &pktlen, passPhrase)
00838 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00839 break;
00840
00841 ret = makeHDRSignature(sig, file, RPMSIGTAG_DSA, passPhrase);
00842 break;
00843 case RPMSIGTAG_RSA:
00844 case RPMSIGTAG_DSA:
00845 case RPMSIGTAG_SHA1:
00846 ret = makeHDRSignature(sig, file, sigTag, passPhrase);
00847 break;
00848 }
00849
00850 return ret;
00851 }
00852
00853 static int checkPassPhrase(const char * passPhrase, const int sigTag)
00854
00855
00856 {
00857 int passPhrasePipe[2];
00858 int pid, status;
00859 int rc;
00860 int xx;
00861
00862 passPhrasePipe[0] = passPhrasePipe[1] = 0;
00863
00864 xx = pipe(passPhrasePipe);
00865
00866 if (!(pid = fork())) {
00867 const char * cmd;
00868 char *const *av;
00869 int fdno;
00870
00871 xx = close(STDIN_FILENO);
00872 xx = close(STDOUT_FILENO);
00873 xx = close(passPhrasePipe[1]);
00874 if (! rpmIsVerbose())
00875 xx = close(STDERR_FILENO);
00876 if ((fdno = open("/dev/null", O_RDONLY)) != STDIN_FILENO) {
00877 xx = dup2(fdno, STDIN_FILENO);
00878 xx = close(fdno);
00879 }
00880 if ((fdno = open("/dev/null", O_WRONLY)) != STDOUT_FILENO) {
00881 xx = dup2(fdno, STDOUT_FILENO);
00882 xx = close(fdno);
00883 }
00884 xx = dup2(passPhrasePipe[0], 3);
00885
00886 unsetenv("MALLOC_CHECK_");
00887 #if defined(__GLIBC__)
00888
00892 {
00893 char* bypassVar = (char*) malloc(1024*sizeof(char));
00894 if (bypassVar != NULL)
00895 {
00896 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00897 bypassVar[1023] = '\0';
00898 if (getenv(bypassVar) != NULL)
00899 {
00900 char* bypassVal = (char*) malloc(1024*sizeof(char));
00901 if (bypassVal != NULL)
00902 {
00903 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00904 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00905 unsetenv(bypassVar);
00906 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00907 bypassVar[1023] = '\0';
00908 putenv(bypassVar);
00909 free(bypassVal);
00910 }
00911 else
00912 {
00913 free(bypassVar);
00914 }
00915 }
00916 }
00917 }
00918 #endif
00919 switch (sigTag) {
00920 case RPMSIGTAG_DSA:
00921 case RPMSIGTAG_GPG:
00922 { const char *gpg_path = rpmExpand("%{?_gpg_path}", NULL);
00923
00924
00925 if (gpg_path && *gpg_path != '\0')
00926 (void) dosetenv("GNUPGHOME", gpg_path, 1);
00927
00928
00929 cmd = rpmExpand("%{?__gpg_check_password_cmd}", NULL);
00930 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00931
00932 if (!rc)
00933 rc = execve(av[0], av+1, environ);
00934
00935
00936 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "gpg",
00937 strerror(errno));
00938 } break;
00939 case RPMSIGTAG_RSA:
00940 case RPMSIGTAG_PGP5:
00941 case RPMSIGTAG_PGP:
00942 { const char *pgp_path = rpmExpand("%{?_pgp_path}", NULL);
00943 const char *path;
00944 pgpVersion pgpVer;
00945
00946 (void) dosetenv("PGPPASSFD", "3", 1);
00947
00948 if (pgp_path && *pgp_path != '\0')
00949 xx = dosetenv("PGPPATH", pgp_path, 1);
00950
00951
00952 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
00953 switch(pgpVer) {
00954 case PGP_2:
00955 cmd = rpmExpand("%{?__pgp_check_password_cmd}", NULL);
00956 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00957
00958 if (!rc)
00959 rc = execve(av[0], av+1, environ);
00960
00961 break;
00962 case PGP_5:
00963 cmd = rpmExpand("%{?__pgp5_check_password_cmd}", NULL);
00964 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00965
00966 if (!rc)
00967 rc = execve(av[0], av+1, environ);
00968
00969 break;
00970 case PGP_UNKNOWN:
00971 case PGP_NOTDETECTED:
00972 break;
00973 }
00974 }
00975 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "pgp",
00976 strerror(errno));
00977 _exit(RPMERR_EXEC);
00978 } break;
00979 default:
00980 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
00981 _exit(RPMERR_SIGGEN);
00982 break;
00983 }
00984 }
00985
00986 xx = close(passPhrasePipe[0]);
00987 xx = write(passPhrasePipe[1], passPhrase, strlen(passPhrase));
00988 xx = write(passPhrasePipe[1], "\n", 1);
00989 xx = close(passPhrasePipe[1]);
00990
00991 (void) waitpid(pid, &status, 0);
00992
00993 return ((!WIFEXITED(status) || WEXITSTATUS(status)) ? 1 : 0);
00994 }
00995
00996 char * rpmGetPassPhrase(const char * prompt, const int sigTag)
00997 {
00998 char *pass;
00999 int aok;
01000
01001 switch (sigTag) {
01002 case RPMSIGTAG_DSA:
01003 case RPMSIGTAG_GPG:
01004
01005 { const char *name = rpmExpand("%{?_gpg_name}", NULL);
01006 aok = (name && *name != '\0');
01007 name = _free(name);
01008 }
01009
01010 if (!aok) {
01011 rpmError(RPMERR_SIGGEN,
01012 _("You must set \"%%_gpg_name\" in your macro file\n"));
01013 return NULL;
01014 }
01015 pass = rpmExpand("%{_gpg_passphrase}", NULL);
01016 pass = (pass && *pass != '%') ? pass : NULL;
01017 break;
01018 case RPMSIGTAG_RSA:
01019 case RPMSIGTAG_PGP5:
01020 case RPMSIGTAG_PGP:
01021
01022 { const char *name = rpmExpand("%{?_pgp_name}", NULL);
01023 aok = (name && *name != '\0');
01024 name = _free(name);
01025 }
01026
01027 if (!aok) {
01028 rpmError(RPMERR_SIGGEN,
01029 _("You must set \"%%_pgp_name\" in your macro file\n"));
01030 return NULL;
01031 }
01032 break;
01033 default:
01034
01035
01036
01037 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
01038 return NULL;
01039 break;
01040 }
01041
01042
01043 if (pass == NULL) {
01044 pass = getpass( (prompt ? prompt : "") ) ;
01045 }
01046
01047
01048 if (checkPassPhrase(pass, sigTag))
01049 return NULL;
01050
01051 return pass;
01052 }
01053
01054 static const char * rpmSigString(rpmRC res)
01055
01056 {
01057 const char * str;
01058 switch (res) {
01059 case RPMRC_OK: str = "OK"; break;
01060 case RPMRC_FAIL: str = "BAD"; break;
01061 case RPMRC_NOKEY: str = "NOKEY"; break;
01062 case RPMRC_NOTTRUSTED: str = "NOTRUSTED"; break;
01063 default:
01064 case RPMRC_NOTFOUND: str = "UNKNOWN"; break;
01065 }
01066 return str;
01067 }
01068
01069
01070 static rpmRC
01071 verifySizeSignature(const rpmts ts, char * t)
01072
01073 {
01074 const void * sig = rpmtsSig(ts);
01075 pgpDig dig = rpmtsDig(ts);
01076 rpmRC res;
01077 int_32 size = 0x7fffffff;
01078
01079 *t = '\0';
01080 t = stpcpy(t, _("Header+Payload size: "));
01081
01082 if (sig == NULL || dig == NULL || dig->nbytes == 0) {
01083 res = RPMRC_NOKEY;
01084 t = stpcpy(t, rpmSigString(res));
01085 goto exit;
01086 }
01087
01088 memcpy(&size, sig, sizeof(size));
01089
01090 if (size != dig->nbytes) {
01091 res = RPMRC_FAIL;
01092 t = stpcpy(t, rpmSigString(res));
01093 sprintf(t, " Expected(%d) != (%d)\n", (int)size, (int)dig->nbytes);
01094 } else {
01095 res = RPMRC_OK;
01096 t = stpcpy(t, rpmSigString(res));
01097 sprintf(t, " (%d)", (int)dig->nbytes);
01098 }
01099
01100 exit:
01101 t = stpcpy(t, "\n");
01102 return res;
01103 }
01104
01105
01106
01107 static rpmRC
01108 verifyMD5Signature(const rpmts ts, char * t,
01109 DIGEST_CTX md5ctx)
01110
01111
01112 {
01113 const void * sig = rpmtsSig(ts);
01114 int_32 siglen = rpmtsSiglen(ts);
01115 pgpDig dig = rpmtsDig(ts);
01116 rpmRC res;
01117 byte * md5sum = NULL;
01118 size_t md5len = 0;
01119
01120 *t = '\0';
01121 t = stpcpy(t, _("MD5 digest: "));
01122
01123 if (md5ctx == NULL || sig == NULL || dig == NULL) {
01124 res = RPMRC_NOKEY;
01125 t = stpcpy(t, rpmSigString(res));
01126 goto exit;
01127 }
01128
01129 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01130 (void) rpmDigestFinal(rpmDigestDup(md5ctx),
01131 (void **)&md5sum, &md5len, 0);
01132 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01133
01134 if (md5len != siglen || memcmp(md5sum, sig, md5len)) {
01135 res = RPMRC_FAIL;
01136 t = stpcpy(t, rpmSigString(res));
01137 t = stpcpy(t, " Expected(");
01138 (void) pgpHexCvt(t, sig, siglen);
01139 t += strlen(t);
01140 t = stpcpy(t, ") != (");
01141 } else {
01142 res = RPMRC_OK;
01143 t = stpcpy(t, rpmSigString(res));
01144 t = stpcpy(t, " (");
01145 }
01146 (void) pgpHexCvt(t, md5sum, md5len);
01147 t += strlen(t);
01148 t = stpcpy(t, ")");
01149
01150 exit:
01151 md5sum = _free(md5sum);
01152 t = stpcpy(t, "\n");
01153 return res;
01154 }
01155
01156
01157
01165 static rpmRC
01166 verifySHA1Signature(const rpmts ts, char * t,
01167 DIGEST_CTX sha1ctx)
01168
01169
01170 {
01171 const void * sig = rpmtsSig(ts);
01172 #ifdef NOTYET
01173 int_32 siglen = rpmtsSiglen(ts);
01174 #endif
01175 pgpDig dig = rpmtsDig(ts);
01176 rpmRC res;
01177 const char * SHA1 = NULL;
01178
01179 *t = '\0';
01180 t = stpcpy(t, _("Header SHA1 digest: "));
01181
01182 if (sha1ctx == NULL || sig == NULL || dig == NULL) {
01183 res = RPMRC_NOKEY;
01184 t = stpcpy(t, rpmSigString(res));
01185 goto exit;
01186 }
01187
01188 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01189 (void) rpmDigestFinal(rpmDigestDup(sha1ctx),
01190 (void **)&SHA1, NULL, 1);
01191 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01192
01193 if (SHA1 == NULL || strlen(SHA1) != strlen(sig) || strcmp(SHA1, sig)) {
01194 res = RPMRC_FAIL;
01195 t = stpcpy(t, rpmSigString(res));
01196 t = stpcpy(t, " Expected(");
01197 t = stpcpy(t, sig);
01198 t = stpcpy(t, ") != (");
01199 } else {
01200 res = RPMRC_OK;
01201 t = stpcpy(t, rpmSigString(res));
01202 t = stpcpy(t, " (");
01203 }
01204 if (SHA1)
01205 t = stpcpy(t, SHA1);
01206 t = stpcpy(t, ")");
01207
01208 exit:
01209 SHA1 = _free(SHA1);
01210 t = stpcpy(t, "\n");
01211 return res;
01212 }
01213
01214
01220 static inline unsigned char nibble(char c)
01221
01222 {
01223 if (c >= '0' && c <= '9')
01224 return (c - '0');
01225 if (c >= 'A' && c <= 'F')
01226 return (c - 'A') + 10;
01227 if (c >= 'a' && c <= 'f')
01228 return (c - 'a') + 10;
01229 return 0;
01230 }
01231
01232
01240 static rpmRC
01241 verifyPGPSignature(rpmts ts, char * t,
01242 DIGEST_CTX md5ctx)
01243
01244
01245 {
01246 const void * sig = rpmtsSig(ts);
01247 #ifdef NOTYET
01248 int_32 siglen = rpmtsSiglen(ts);
01249 #endif
01250 int_32 sigtag = rpmtsSigtag(ts);
01251 pgpDig dig = rpmtsDig(ts);
01252 pgpDigParams sigp = rpmtsSignature(ts);
01253 rpmRC res;
01254 int xx;
01255
01256 *t = '\0';
01257 t = stpcpy(t, _("V3 RSA/MD5 signature: "));
01258
01259 if (md5ctx == NULL || sig == NULL || dig == NULL || sigp == NULL) {
01260 res = RPMRC_NOKEY;
01261 goto exit;
01262 }
01263
01264
01265 if (!(sigtag == RPMSIGTAG_PGP
01266 && sigp->pubkey_algo == PGPPUBKEYALGO_RSA
01267 && sigp->hash_algo == PGPHASHALGO_MD5))
01268 {
01269 res = RPMRC_NOKEY;
01270 goto exit;
01271 }
01272
01273 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01274 { DIGEST_CTX ctx = rpmDigestDup(md5ctx);
01275 byte signhash16[2];
01276 const char * s;
01277
01278 if (sigp->hash != NULL)
01279 xx = rpmDigestUpdate(ctx, sigp->hash, sigp->hashlen);
01280
01281 #ifdef NOTYET
01282 if (sigp->sigtype == 4) {
01283 int nb = dig->nbytes + sigp->hashlen;
01284 byte trailer[6];
01285 nb = htonl(nb);
01286 trailer[0] = 0x4;
01287 trailer[1] = 0xff;
01288 memcpy(trailer+2, &nb, sizeof(nb));
01289 xx = rpmDigestUpdate(ctx, trailer, sizeof(trailer));
01290 }
01291 #endif
01292
01293 xx = rpmDigestFinal(ctx, (void **)&dig->md5, &dig->md5len, 1);
01294 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), sigp->hashlen);
01295
01296
01297 s = dig->md5;
01298 signhash16[0] = (nibble(s[0]) << 4) | nibble(s[1]);
01299 signhash16[1] = (nibble(s[2]) << 4) | nibble(s[3]);
01300 if (memcmp(signhash16, sigp->signhash16, sizeof(signhash16))) {
01301 res = RPMRC_FAIL;
01302 goto exit;
01303 }
01304
01305 }
01306
01307 { const char * prefix = "3020300c06082a864886f70d020505000410";
01308 unsigned int nbits = 1024;
01309 unsigned int nb = (nbits + 7) >> 3;
01310 const char * hexstr;
01311 char * tt;
01312
01313 hexstr = tt = xmalloc(2 * nb + 1);
01314 memset(tt, 'f', (2 * nb));
01315 tt[0] = '0'; tt[1] = '0';
01316 tt[2] = '0'; tt[3] = '1';
01317 tt += (2 * nb) - strlen(prefix) - strlen(dig->md5) - 2;
01318 *tt++ = '0'; *tt++ = '0';
01319 tt = stpcpy(tt, prefix);
01320 tt = stpcpy(tt, dig->md5);
01321
01322 mpnzero(&dig->rsahm); mpnsethex(&dig->rsahm, hexstr);
01323
01324 hexstr = _free(hexstr);
01325
01326 }
01327
01328
01329 res = rpmtsFindPubkey(ts);
01330 if (res != RPMRC_OK)
01331 goto exit;
01332
01333 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01334 #if HAVE_BEECRYPT_API_H
01335 xx = rsavrfy(&dig->rsa_pk.n, &dig->rsa_pk.e, &dig->rsahm, &dig->c);
01336 #else
01337 xx = rsavrfy(&dig->rsa_pk, &dig->rsahm, &dig->c);
01338 #endif
01339 if (xx)
01340 res = RPMRC_OK;
01341 else
01342 res = RPMRC_FAIL;
01343 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01344
01345 exit:
01346 t = stpcpy(t, rpmSigString(res));
01347 if (sigp != NULL) {
01348 t = stpcpy(t, ", key ID ");
01349 (void) pgpHexCvt(t, sigp->signid+4, sizeof(sigp->signid)-4);
01350 t += strlen(t);
01351 }
01352 t = stpcpy(t, "\n");
01353 return res;
01354 }
01355
01356
01364
01365 static rpmRC
01366 verifyGPGSignature(rpmts ts, char * t,
01367 DIGEST_CTX sha1ctx)
01368
01369
01370 {
01371 const void * sig = rpmtsSig(ts);
01372 #ifdef NOTYET
01373 int_32 siglen = rpmtsSiglen(ts);
01374 #endif
01375 int_32 sigtag = rpmtsSigtag(ts);
01376 pgpDig dig = rpmtsDig(ts);
01377 pgpDigParams sigp = rpmtsSignature(ts);
01378 rpmRC res;
01379 int xx;
01380
01381 *t = '\0';
01382 if (dig != NULL && dig->hdrsha1ctx == sha1ctx)
01383 t = stpcpy(t, _("Header "));
01384 t = stpcpy(t, _("V3 DSA signature: "));
01385
01386 if (sha1ctx == NULL || sig == NULL || dig == NULL || sigp == NULL) {
01387 res = RPMRC_NOKEY;
01388 goto exit;
01389 }
01390
01391
01392 if (!((sigtag == RPMSIGTAG_GPG || sigtag == RPMSIGTAG_DSA)
01393 && sigp->pubkey_algo == PGPPUBKEYALGO_DSA
01394 && sigp->hash_algo == PGPHASHALGO_SHA1))
01395 {
01396 res = RPMRC_NOKEY;
01397 goto exit;
01398 }
01399
01400 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01401 { DIGEST_CTX ctx = rpmDigestDup(sha1ctx);
01402 byte signhash16[2];
01403
01404 if (sigp->hash != NULL)
01405 xx = rpmDigestUpdate(ctx, sigp->hash, sigp->hashlen);
01406
01407 #ifdef NOTYET
01408 if (sigp->sigtype == 4) {
01409 int nb = dig->nbytes + sigp->hashlen;
01410 byte trailer[6];
01411 nb = htonl(nb);
01412 trailer[0] = 0x4;
01413 trailer[1] = 0xff;
01414 memcpy(trailer+2, &nb, sizeof(nb));
01415 xx = rpmDigestUpdate(ctx, trailer, sizeof(trailer));
01416 }
01417 #endif
01418 xx = rpmDigestFinal(ctx, (void **)&dig->sha1, &dig->sha1len, 1);
01419 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), sigp->hashlen);
01420
01421 mpnzero(&dig->hm); mpnsethex(&dig->hm, dig->sha1);
01422
01423
01424 signhash16[0] = (*dig->hm.data >> 24) & 0xff;
01425 signhash16[1] = (*dig->hm.data >> 16) & 0xff;
01426 if (memcmp(signhash16, sigp->signhash16, sizeof(signhash16))) {
01427 res = RPMRC_FAIL;
01428 goto exit;
01429 }
01430 }
01431
01432
01433 res = rpmtsFindPubkey(ts);
01434 if (res != RPMRC_OK)
01435 goto exit;
01436
01437 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01438 if (dsavrfy(&dig->p, &dig->q, &dig->g,
01439 &dig->hm, &dig->y, &dig->r, &dig->s))
01440 res = RPMRC_OK;
01441 else
01442 res = RPMRC_FAIL;
01443 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01444
01445 exit:
01446 t = stpcpy(t, rpmSigString(res));
01447 if (sigp != NULL) {
01448 t = stpcpy(t, ", key ID ");
01449 (void) pgpHexCvt(t, sigp->signid+4, sizeof(sigp->signid)-4);
01450 t += strlen(t);
01451 }
01452 t = stpcpy(t, "\n");
01453 return res;
01454 }
01455
01456
01457 rpmRC
01458 rpmVerifySignature(const rpmts ts, char * result)
01459 {
01460 const void * sig = rpmtsSig(ts);
01461 int_32 siglen = rpmtsSiglen(ts);
01462 int_32 sigtag = rpmtsSigtag(ts);
01463 pgpDig dig = rpmtsDig(ts);
01464 rpmRC res;
01465
01466 if (sig == NULL || siglen <= 0 || dig == NULL) {
01467 sprintf(result, _("Verify signature: BAD PARAMETERS\n"));
01468 return RPMRC_NOTFOUND;
01469 }
01470
01471 switch (sigtag) {
01472 case RPMSIGTAG_SIZE:
01473 res = verifySizeSignature(ts, result);
01474 break;
01475 case RPMSIGTAG_MD5:
01476 res = verifyMD5Signature(ts, result, dig->md5ctx);
01477 break;
01478 case RPMSIGTAG_SHA1:
01479 res = verifySHA1Signature(ts, result, dig->hdrsha1ctx);
01480 break;
01481 case RPMSIGTAG_RSA:
01482 case RPMSIGTAG_PGP5:
01483 case RPMSIGTAG_PGP:
01484 res = verifyPGPSignature(ts, result, dig->md5ctx);
01485 break;
01486 case RPMSIGTAG_DSA:
01487 res = verifyGPGSignature(ts, result, dig->hdrsha1ctx);
01488 break;
01489 case RPMSIGTAG_GPG:
01490 res = verifyGPGSignature(ts, result, dig->sha1ctx);
01491 break;
01492 case RPMSIGTAG_LEMD5_1:
01493 case RPMSIGTAG_LEMD5_2:
01494 sprintf(result, _("Broken MD5 digest: UNSUPPORTED\n"));
01495 res = RPMRC_NOTFOUND;
01496 break;
01497 default:
01498 sprintf(result, _("Signature: UNKNOWN (%d)\n"), sigtag);
01499 res = RPMRC_NOTFOUND;
01500 break;
01501 }
01502 return res;
01503 }