00001
00005 #include "system.h"
00006
00007 #include "rpmio_internal.h"
00008 #include <rpmlib.h>
00009 #include <rpmmacro.h>
00010 #include "rpmdb.h"
00011
00012 #include "rpmts.h"
00013
00014 #include "misc.h"
00015 #include "legacy.h"
00016 #include "rpmlead.h"
00017 #include "signature.h"
00018 #include "header_internal.h"
00019 #include "debug.h"
00020
00021
00022
00023
00024
00025
00026
00027
00028
00029 #if !defined(__GLIBC__)
00030 char ** environ = NULL;
00031 #endif
00032
00033 int rpmLookupSignatureType(int action)
00034 {
00035
00036 static int disabled = 0;
00037 int rc = 0;
00038
00039 switch (action) {
00040 case RPMLOOKUPSIG_DISABLE:
00041 disabled = -2;
00042 break;
00043 case RPMLOOKUPSIG_ENABLE:
00044 disabled = 0;
00045
00046 case RPMLOOKUPSIG_QUERY:
00047 if (disabled)
00048 break;
00049
00050 { const char *name = rpmExpand("%{?_signature}", NULL);
00051 if (!(name && *name != '\0'))
00052 rc = 0;
00053 else if (!xstrcasecmp(name, "none"))
00054 rc = 0;
00055 else if (!xstrcasecmp(name, "pgp"))
00056 rc = RPMSIGTAG_PGP;
00057 else if (!xstrcasecmp(name, "pgp5"))
00058 rc = RPMSIGTAG_PGP;
00059 else if (!xstrcasecmp(name, "gpg"))
00060 rc = RPMSIGTAG_GPG;
00061 else
00062 rc = -1;
00063 name = _free(name);
00064 } break;
00065
00066 }
00067 return rc;
00068 }
00069
00070
00071
00072
00073 const char * rpmDetectPGPVersion(pgpVersion * pgpVer)
00074 {
00075
00076
00077
00078
00079 static pgpVersion saved_pgp_version = PGP_UNKNOWN;
00080 const char *pgpbin = rpmGetPath("%{?_pgpbin}", NULL);
00081
00082 if (saved_pgp_version == PGP_UNKNOWN) {
00083 char *pgpvbin;
00084 struct stat st;
00085
00086
00087 if (!(pgpbin && pgpbin[0] != '\0')) {
00088 pgpbin = _free(pgpbin);
00089 saved_pgp_version = -1;
00090 return NULL;
00091 }
00092
00093
00094 pgpvbin = (char *)alloca(strlen(pgpbin) + sizeof("v"));
00095 (void)stpcpy(stpcpy(pgpvbin, pgpbin), "v");
00096
00097
00098 if (stat(pgpvbin, &st) == 0)
00099 saved_pgp_version = PGP_5;
00100 else if (stat(pgpbin, &st) == 0)
00101 saved_pgp_version = PGP_2;
00102 else
00103 saved_pgp_version = PGP_NOTDETECTED;
00104 }
00105
00106
00107 if (pgpVer && pgpbin)
00108 *pgpVer = saved_pgp_version;
00109
00110 return pgpbin;
00111 }
00112
00122 static inline rpmRC printSize(FD_t fd, int siglen, int pad, int datalen)
00123
00124
00125 {
00126 struct stat st;
00127
00128 if (fstat(Fileno(fd), &st) < 0)
00129 return RPMRC_FAIL;
00130
00131
00132 rpmMessage(RPMMESS_DEBUG,
00133 _("Expected size: %12d = lead(%d)+sigs(%d)+pad(%d)+data(%d)\n"),
00134 (int)sizeof(struct rpmlead)+siglen+pad+datalen,
00135 (int)sizeof(struct rpmlead), siglen, pad, datalen);
00136
00137 rpmMessage(RPMMESS_DEBUG,
00138 _(" Actual size: %12d\n"), (int)st.st_size);
00139
00140 return RPMRC_OK;
00141 }
00142
00143
00144 static unsigned char header_magic[8] = {
00145 0x8e, 0xad, 0xe8, 0x01, 0x00, 0x00, 0x00, 0x00
00146 };
00147
00148 rpmRC rpmReadSignature(FD_t fd, Header * sighp, sigType sig_type,
00149 const char ** msg)
00150 {
00151 char buf[BUFSIZ];
00152 int_32 block[4];
00153 int_32 il;
00154 int_32 dl;
00155 int_32 * ei = NULL;
00156 entryInfo pe;
00157 size_t nb;
00158 int_32 ril = 0;
00159 indexEntry entry = memset(alloca(sizeof(*entry)), 0, sizeof(*entry));
00160 entryInfo info = memset(alloca(sizeof(*info)), 0, sizeof(*info));
00161 unsigned char * dataStart;
00162 unsigned char * dataEnd = NULL;
00163 Header sigh = NULL;
00164 rpmRC rc = RPMRC_FAIL;
00165 int xx;
00166 int i;
00167
00168
00169 if (sighp)
00170 *sighp = NULL;
00171
00172 buf[0] = '\0';
00173
00174
00175 if (sig_type != RPMSIGTYPE_HEADERSIG)
00176 goto exit;
00177
00178 memset(block, 0, sizeof(block));
00179 if ((xx = timedRead(fd, (char *)block, sizeof(block))) != sizeof(block)) {
00180 (void) snprintf(buf, sizeof(buf),
00181 _("sigh size(%d): BAD, read returned %d\n"), (int)sizeof(block), xx);
00182 goto exit;
00183 }
00184 if (memcmp(block, header_magic, sizeof(header_magic))) {
00185 (void) snprintf(buf, sizeof(buf),
00186 _("sigh magic: BAD\n"));
00187 goto exit;
00188 }
00189
00190 il = ntohl(block[2]);
00191
00192 if (il < 0 || il > 32) {
00193 (void) snprintf(buf, sizeof(buf),
00194 _("sigh tags: BAD, no. of tags(%d) out of range\n"), il);
00195 goto exit;
00196 }
00197
00198 dl = ntohl(block[3]);
00199
00200 if (dl < 0 || dl > 8192) {
00201 (void) snprintf(buf, sizeof(buf),
00202 _("sigh data: BAD, no. of bytes(%d) out of range\n"), dl);
00203 goto exit;
00204 }
00205
00206
00207 nb = (il * sizeof(struct entryInfo_s)) + dl;
00208
00209 ei = xmalloc(sizeof(il) + sizeof(dl) + nb);
00210
00211 ei[0] = block[2];
00212 ei[1] = block[3];
00213 pe = (entryInfo) &ei[2];
00214
00215 dataStart = (unsigned char *) (pe + il);
00216 if ((xx = timedRead(fd, (char *)pe, nb)) != nb) {
00217 (void) snprintf(buf, sizeof(buf),
00218 _("sigh blob(%d): BAD, read returned %d\n"), (int)nb, xx);
00219 goto exit;
00220 }
00221
00222
00223 xx = headerVerifyInfo(1, dl, pe, &entry->info, 0);
00224 if (xx != -1) {
00225 (void) snprintf(buf, sizeof(buf),
00226 _("tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
00227 0, entry->info.tag, entry->info.type,
00228 entry->info.offset, entry->info.count);
00229 goto exit;
00230 }
00231
00232
00233
00234 if (entry->info.tag == RPMTAG_HEADERSIGNATURES
00235 && entry->info.type == RPM_BIN_TYPE
00236 && entry->info.count == REGION_TAG_COUNT)
00237 {
00238
00239
00240 if (entry->info.offset >= dl) {
00241 (void) snprintf(buf, sizeof(buf),
00242 _("region offset: BAD, tag %d type %d offset %d count %d\n"),
00243 entry->info.tag, entry->info.type,
00244 entry->info.offset, entry->info.count);
00245 goto exit;
00246 }
00247
00248
00249 dataEnd = dataStart + entry->info.offset;
00250
00251
00252 (void) memcpy(info, dataEnd, REGION_TAG_COUNT);
00253
00254 dataEnd += REGION_TAG_COUNT;
00255
00256 xx = headerVerifyInfo(1, dl, info, &entry->info, 1);
00257 if (xx != -1 ||
00258 !(entry->info.tag == RPMTAG_HEADERSIGNATURES
00259 && entry->info.type == RPM_BIN_TYPE
00260 && entry->info.count == REGION_TAG_COUNT))
00261 {
00262 (void) snprintf(buf, sizeof(buf),
00263 _("region trailer: BAD, tag %d type %d offset %d count %d\n"),
00264 entry->info.tag, entry->info.type,
00265 entry->info.offset, entry->info.count);
00266 goto exit;
00267 }
00268
00269
00270 memset(info, 0, sizeof(*info));
00271
00272
00273
00274 ril = entry->info.offset/sizeof(*pe);
00275 if ((entry->info.offset % sizeof(*pe)) || ril > il) {
00276 (void) snprintf(buf, sizeof(buf),
00277 _("region size: BAD, ril(%d) > il(%d)\n"), ril, il);
00278 goto exit;
00279 }
00280 }
00281
00282
00283
00284 memset(info, 0, sizeof(*info));
00285
00286 for (i = 1; i < il; i++) {
00287 xx = headerVerifyInfo(1, dl, pe+i, &entry->info, 0);
00288 if (xx != -1) {
00289 (void) snprintf(buf, sizeof(buf),
00290 _("sigh tag[%d]: BAD, tag %d type %d offset %d count %d\n"),
00291 i, entry->info.tag, entry->info.type,
00292 entry->info.offset, entry->info.count);
00293 goto exit;
00294 }
00295 }
00296
00297
00298 sigh = headerLoad(ei);
00299 if (sigh == NULL) {
00300 (void) snprintf(buf, sizeof(buf), _("sigh load: BAD\n"));
00301 goto exit;
00302 }
00303 sigh->flags |= HEADERFLAG_ALLOCATED;
00304
00305 { int sigSize = headerSizeof(sigh, HEADER_MAGIC_YES);
00306 int pad = (8 - (sigSize % 8)) % 8;
00307 int_32 * archSize = NULL;
00308
00309
00310 if (pad && (xx = timedRead(fd, (char *)block, pad)) != pad) {
00311 (void) snprintf(buf, sizeof(buf),
00312 _("sigh pad(%d): BAD, read %d bytes\n"), pad, xx);
00313 goto exit;
00314 }
00315
00316
00317 if (headerGetEntry(sigh, RPMSIGTAG_SIZE, NULL,(void **)&archSize, NULL))
00318 rc = printSize(fd, sigSize, pad, *archSize);
00319 }
00320
00321 exit:
00322
00323 if (sighp && sigh && rc == RPMRC_OK)
00324 *sighp = headerLink(sigh);
00325 sigh = headerFree(sigh);
00326
00327 if (msg != NULL) {
00328 buf[sizeof(buf)-1] = '\0';
00329 *msg = xstrdup(buf);
00330 }
00331
00332
00333 return rc;
00334 }
00335
00336 int rpmWriteSignature(FD_t fd, Header h)
00337 {
00338 static byte buf[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
00339 int sigSize, pad;
00340 int rc;
00341
00342 rc = headerWrite(fd, h, HEADER_MAGIC_YES);
00343 if (rc)
00344 return rc;
00345
00346 sigSize = headerSizeof(h, HEADER_MAGIC_YES);
00347 pad = (8 - (sigSize % 8)) % 8;
00348 if (pad) {
00349
00350 if (Fwrite(buf, sizeof(buf[0]), pad, fd) != pad)
00351 rc = 1;
00352
00353 }
00354 rpmMessage(RPMMESS_DEBUG, _("Signature: size(%d)+pad(%d)\n"), sigSize, pad);
00355 return rc;
00356 }
00357
00358 Header rpmNewSignature(void)
00359 {
00360 Header h = headerNew();
00361 return h;
00362 }
00363
00364 Header rpmFreeSignature(Header h)
00365 {
00366 return headerFree(h);
00367 }
00368
00377 static int makePGPSignature(const char * file, byte ** pkt,
00378 int_32 * pktlen, const char * passPhrase)
00379
00380
00381
00382
00383 {
00384 char * sigfile = alloca(1024);
00385 int pid, status;
00386 int inpipe[2];
00387 struct stat st;
00388 const char * cmd;
00389 char *const *av;
00390 int rc;
00391
00392
00393 (void) stpcpy( stpcpy(sigfile, file), ".sig");
00394
00395
00396 addMacro(NULL, "__plaintext_filename", NULL, file, -1);
00397 addMacro(NULL, "__signature_filename", NULL, sigfile, -1);
00398
00399 inpipe[0] = inpipe[1] = 0;
00400
00401 (void) pipe(inpipe);
00402
00403
00404 if (!(pid = fork())) {
00405 const char *pgp_path = rpmExpand("%{?_pgp_path}", NULL);
00406 const char *path;
00407 pgpVersion pgpVer;
00408
00409 (void) close(STDIN_FILENO);
00410 (void) dup2(inpipe[0], 3);
00411 (void) close(inpipe[1]);
00412
00413 (void) dosetenv("PGPPASSFD", "3", 1);
00414
00415 if (pgp_path && *pgp_path != '\0')
00416 (void) dosetenv("PGPPATH", pgp_path, 1);
00417
00418
00419
00420
00421 unsetenv("MALLOC_CHECK_");
00422 #if defined(__GLIBC__)
00423
00427 {
00428 char* bypassVar = (char*) malloc(1024*sizeof(char));
00429 if (bypassVar != NULL)
00430 {
00431 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00432 bypassVar[1023] = '\0';
00433 if (getenv(bypassVar) != NULL)
00434 {
00435 char* bypassVal = (char*) malloc(1024*sizeof(char));
00436 if (bypassVal != NULL)
00437 {
00438 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00439 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00440 unsetenv(bypassVar);
00441 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00442 bypassVar[1023] = '\0';
00443 putenv(bypassVar);
00444 free(bypassVal);
00445 }
00446 else
00447 {
00448 free(bypassVar);
00449 }
00450 }
00451 }
00452 }
00453 #endif
00454 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
00455 switch(pgpVer) {
00456 case PGP_2:
00457 cmd = rpmExpand("%{?__pgp_sign_cmd}", NULL);
00458 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00459
00460 if (!rc)
00461 rc = execve(av[0], av+1, environ);
00462
00463 break;
00464 case PGP_5:
00465 cmd = rpmExpand("%{?__pgp5_sign_cmd}", NULL);
00466 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00467
00468 if (!rc)
00469 rc = execve(av[0], av+1, environ);
00470
00471 break;
00472 case PGP_UNKNOWN:
00473 case PGP_NOTDETECTED:
00474 errno = ENOENT;
00475 break;
00476 }
00477 }
00478 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "pgp",
00479 strerror(errno));
00480 _exit(RPMERR_EXEC);
00481 }
00482
00483 delMacro(NULL, "__plaintext_filename");
00484 delMacro(NULL, "__signature_filename");
00485
00486 (void) close(inpipe[0]);
00487 if (passPhrase)
00488 (void) write(inpipe[1], passPhrase, strlen(passPhrase));
00489 (void) write(inpipe[1], "\n", 1);
00490 (void) close(inpipe[1]);
00491
00492 (void)waitpid(pid, &status, 0);
00493 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
00494 rpmError(RPMERR_SIGGEN, _("pgp failed\n"));
00495 return 1;
00496 }
00497
00498 if (stat(sigfile, &st)) {
00499
00500 if (sigfile) (void) unlink(sigfile);
00501 rpmError(RPMERR_SIGGEN, _("pgp failed to write signature\n"));
00502 return 1;
00503 }
00504
00505
00506 *pktlen = st.st_size;
00507 rpmMessage(RPMMESS_DEBUG, _("PGP sig size: %d\n"), *pktlen);
00508 *pkt = xmalloc(*pktlen);
00509
00510
00511
00512 { FD_t fd;
00513
00514 rc = 0;
00515 fd = Fopen(sigfile, "r.fdio");
00516 if (fd != NULL && !Ferror(fd)) {
00517 rc = timedRead(fd, *pkt, *pktlen);
00518 if (sigfile) (void) unlink(sigfile);
00519 (void) Fclose(fd);
00520 }
00521 if (rc != *pktlen) {
00522
00523 *pkt = _free(*pkt);
00524
00525 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
00526 return 1;
00527 }
00528 }
00529
00530 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of PGP sig\n"), *pktlen);
00531
00532
00533 return 0;
00534 }
00535
00544 static int makeGPGSignature(const char * file, byte ** pkt,
00545 int_32 * pktlen, const char * passPhrase)
00546
00547
00548
00549
00550 {
00551 char * sigfile = alloca(1024);
00552 int pid, status;
00553 int inpipe[2];
00554 FILE * fpipe;
00555 struct stat st;
00556 const char * cmd;
00557 char *const *av;
00558 int rc;
00559
00560
00561 (void) stpcpy( stpcpy(sigfile, file), ".sig");
00562
00563
00564 addMacro(NULL, "__plaintext_filename", NULL, file, -1);
00565 addMacro(NULL, "__signature_filename", NULL, sigfile, -1);
00566
00567 inpipe[0] = inpipe[1] = 0;
00568
00569 (void) pipe(inpipe);
00570
00571
00572 if (!(pid = fork())) {
00573 const char *gpg_path = rpmExpand("%{?_gpg_path}", NULL);
00574
00575 (void) close(STDIN_FILENO);
00576 (void) dup2(inpipe[0], 3);
00577 (void) close(inpipe[1]);
00578
00579
00580 if (gpg_path && *gpg_path != '\0')
00581 (void) dosetenv("GNUPGHOME", gpg_path, 1);
00582
00583
00584 unsetenv("MALLOC_CHECK_");
00585
00586 #if defined(__GLIBC__)
00587
00591 {
00592 char* bypassVar = (char*) malloc(1024*sizeof(char));
00593 if (bypassVar != NULL)
00594 {
00595 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00596 bypassVar[1023] = '\0';
00597 if (getenv(bypassVar) != NULL)
00598 {
00599 char* bypassVal = (char*) malloc(1024*sizeof(char));
00600 if (bypassVal != NULL)
00601 {
00602 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00603 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00604 unsetenv(bypassVar);
00605 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00606 bypassVar[1023] = '\0';
00607 putenv(bypassVar);
00608 free(bypassVal);
00609 }
00610 else
00611 {
00612 free(bypassVar);
00613 }
00614 }
00615 }
00616 }
00617 #endif
00618 cmd = rpmExpand("%{?__gpg_sign_cmd}", NULL);
00619 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00620
00621 if (!rc)
00622 rc = execve(av[0], av+1, environ);
00623
00624
00625 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "gpg",
00626 strerror(errno));
00627 _exit(RPMERR_EXEC);
00628 }
00629
00630 delMacro(NULL, "__plaintext_filename");
00631 delMacro(NULL, "__signature_filename");
00632
00633 fpipe = fdopen(inpipe[1], "w");
00634 (void) close(inpipe[0]);
00635 if (fpipe) {
00636 fprintf(fpipe, "%s\n", (passPhrase ? passPhrase : ""));
00637 (void) fclose(fpipe);
00638 }
00639
00640 (void) waitpid(pid, &status, 0);
00641 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
00642 rpmError(RPMERR_SIGGEN, _("gpg failed\n"));
00643 return 1;
00644 }
00645
00646 if (stat(sigfile, &st)) {
00647
00648 if (sigfile) (void) unlink(sigfile);
00649 rpmError(RPMERR_SIGGEN, _("gpg failed to write signature\n"));
00650 return 1;
00651 }
00652
00653
00654 *pktlen = st.st_size;
00655 rpmMessage(RPMMESS_DEBUG, _("GPG sig size: %d\n"), *pktlen);
00656 *pkt = xmalloc(*pktlen);
00657
00658
00659
00660 { FD_t fd;
00661
00662 rc = 0;
00663 fd = Fopen(sigfile, "r.fdio");
00664 if (fd != NULL && !Ferror(fd)) {
00665 rc = timedRead(fd, *pkt, *pktlen);
00666 if (sigfile) (void) unlink(sigfile);
00667 (void) Fclose(fd);
00668 }
00669 if (rc != *pktlen) {
00670
00671 *pkt = _free(*pkt);
00672
00673 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
00674 return 1;
00675 }
00676 }
00677
00678 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of GPG sig\n"), *pktlen);
00679
00680
00681 return 0;
00682 }
00683
00692 static int makeHDRSignature(Header sig, const char * file, int_32 sigTag,
00693 const char * passPhrase)
00694
00695
00696 {
00697 Header h = NULL;
00698 FD_t fd = NULL;
00699 byte * pkt;
00700 int_32 pktlen;
00701 const char * fn = NULL;
00702 const char * SHA1 = NULL;
00703 int ret = -1;
00704
00705 switch (sigTag) {
00706 case RPMSIGTAG_SIZE:
00707 case RPMSIGTAG_MD5:
00708 case RPMSIGTAG_PGP5:
00709 case RPMSIGTAG_PGP:
00710 case RPMSIGTAG_GPG:
00711 goto exit;
00712 break;
00713 case RPMSIGTAG_SHA1:
00714 fd = Fopen(file, "r.fdio");
00715 if (fd == NULL || Ferror(fd))
00716 goto exit;
00717 h = headerRead(fd, HEADER_MAGIC_YES);
00718 if (h == NULL)
00719 goto exit;
00720 (void) Fclose(fd); fd = NULL;
00721
00722 if (headerIsEntry(h, RPMTAG_HEADERIMMUTABLE)) {
00723 DIGEST_CTX ctx;
00724 void * uh;
00725 int_32 uht, uhc;
00726
00727 if (!headerGetEntry(h, RPMTAG_HEADERIMMUTABLE, &uht, &uh, &uhc)
00728 || uh == NULL)
00729 {
00730 h = headerFree(h);
00731 goto exit;
00732 }
00733 ctx = rpmDigestInit(PGPHASHALGO_SHA1, RPMDIGEST_NONE);
00734 (void) rpmDigestUpdate(ctx, header_magic, sizeof(header_magic));
00735 (void) rpmDigestUpdate(ctx, uh, uhc);
00736 (void) rpmDigestFinal(ctx, (void **)&SHA1, NULL, 1);
00737 uh = headerFreeData(uh, uht);
00738 }
00739 h = headerFree(h);
00740
00741 if (SHA1 == NULL)
00742 goto exit;
00743 if (!headerAddEntry(sig, RPMSIGTAG_SHA1, RPM_STRING_TYPE, SHA1, 1))
00744 goto exit;
00745 ret = 0;
00746 break;
00747 case RPMSIGTAG_DSA:
00748 fd = Fopen(file, "r.fdio");
00749 if (fd == NULL || Ferror(fd))
00750 goto exit;
00751 h = headerRead(fd, HEADER_MAGIC_YES);
00752 if (h == NULL)
00753 goto exit;
00754 (void) Fclose(fd); fd = NULL;
00755 if (makeTempFile(NULL, &fn, &fd))
00756 goto exit;
00757 if (headerWrite(fd, h, HEADER_MAGIC_YES))
00758 goto exit;
00759 (void) Fclose(fd); fd = NULL;
00760 if (makeGPGSignature(fn, &pkt, &pktlen, passPhrase)
00761 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00762 goto exit;
00763 ret = 0;
00764 break;
00765 case RPMSIGTAG_RSA:
00766 fd = Fopen(file, "r.fdio");
00767 if (fd == NULL || Ferror(fd))
00768 goto exit;
00769 h = headerRead(fd, HEADER_MAGIC_YES);
00770 if (h == NULL)
00771 goto exit;
00772 (void) Fclose(fd); fd = NULL;
00773 if (makeTempFile(NULL, &fn, &fd))
00774 goto exit;
00775 if (headerWrite(fd, h, HEADER_MAGIC_YES))
00776 goto exit;
00777 (void) Fclose(fd); fd = NULL;
00778 if (makePGPSignature(fn, &pkt, &pktlen, passPhrase)
00779 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00780 goto exit;
00781 ret = 0;
00782 break;
00783 }
00784
00785 exit:
00786 if (fn) {
00787 (void) unlink(fn);
00788 fn = _free(fn);
00789 }
00790 SHA1 = _free(SHA1);
00791 h = headerFree(h);
00792 if (fd != NULL) (void) Fclose(fd);
00793 return ret;
00794 }
00795
00796 int rpmAddSignature(Header sig, const char * file, int_32 sigTag,
00797 const char * passPhrase)
00798 {
00799 struct stat st;
00800 byte * pkt;
00801 int_32 pktlen;
00802 int ret = -1;
00803
00804 switch (sigTag) {
00805 case RPMSIGTAG_SIZE:
00806 if (stat(file, &st) != 0)
00807 break;
00808 pktlen = st.st_size;
00809 if (!headerAddEntry(sig, sigTag, RPM_INT32_TYPE, &pktlen, 1))
00810 break;
00811 ret = 0;
00812 break;
00813 case RPMSIGTAG_MD5:
00814 pktlen = 16;
00815 pkt = memset(alloca(pktlen), 0, pktlen);
00816 if (domd5(file, pkt, 0, NULL)
00817 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00818 break;
00819 ret = 0;
00820 break;
00821 case RPMSIGTAG_PGP5:
00822 case RPMSIGTAG_PGP:
00823 if (makePGPSignature(file, &pkt, &pktlen, passPhrase)
00824 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00825 break;
00826 #ifdef NOTYET
00827
00828 ret = makeHDRSignature(sig, file, RPMSIGTAG_RSA, passPhrase);
00829 #endif
00830 ret = 0;
00831 break;
00832 case RPMSIGTAG_GPG:
00833 if (makeGPGSignature(file, &pkt, &pktlen, passPhrase)
00834 || !headerAddEntry(sig, sigTag, RPM_BIN_TYPE, pkt, pktlen))
00835 break;
00836
00837 ret = makeHDRSignature(sig, file, RPMSIGTAG_DSA, passPhrase);
00838 break;
00839 case RPMSIGTAG_RSA:
00840 case RPMSIGTAG_DSA:
00841 case RPMSIGTAG_SHA1:
00842 ret = makeHDRSignature(sig, file, sigTag, passPhrase);
00843 break;
00844 }
00845
00846 return ret;
00847 }
00848
00849 static int checkPassPhrase(const char * passPhrase, const int sigTag)
00850
00851
00852 {
00853 int passPhrasePipe[2];
00854 int pid, status;
00855 int rc;
00856 int xx;
00857
00858 passPhrasePipe[0] = passPhrasePipe[1] = 0;
00859
00860 xx = pipe(passPhrasePipe);
00861
00862 if (!(pid = fork())) {
00863 const char * cmd;
00864 char *const *av;
00865 int fdno;
00866
00867 xx = close(STDIN_FILENO);
00868 xx = close(STDOUT_FILENO);
00869 xx = close(passPhrasePipe[1]);
00870 if (! rpmIsVerbose())
00871 xx = close(STDERR_FILENO);
00872 if ((fdno = open("/dev/null", O_RDONLY)) != STDIN_FILENO) {
00873 xx = dup2(fdno, STDIN_FILENO);
00874 xx = close(fdno);
00875 }
00876 if ((fdno = open("/dev/null", O_WRONLY)) != STDOUT_FILENO) {
00877 xx = dup2(fdno, STDOUT_FILENO);
00878 xx = close(fdno);
00879 }
00880 xx = dup2(passPhrasePipe[0], 3);
00881
00882 unsetenv("MALLOC_CHECK_");
00883 #if defined(__GLIBC__)
00884
00888 {
00889 char* bypassVar = (char*) malloc(1024*sizeof(char));
00890 if (bypassVar != NULL)
00891 {
00892 snprintf(bypassVar,1024*sizeof(char), "__PASSTHROUGH_LD_ASSUME_KERNEL_%d", getppid());
00893 bypassVar[1023] = '\0';
00894 if (getenv(bypassVar) != NULL)
00895 {
00896 char* bypassVal = (char*) malloc(1024*sizeof(char));
00897 if (bypassVal != NULL)
00898 {
00899 rpmMessage(RPMMESS_DEBUG, _("Restoring LD_ASSUME_KERNEL for child scripts.\n"));
00900 snprintf(bypassVal, 1024*sizeof(char), "%s", getenv(bypassVar));
00901 unsetenv(bypassVar);
00902 snprintf(bypassVar, 1024*sizeof(char), "LD_ASSUME_KERNEL=%s", bypassVal);
00903 bypassVar[1023] = '\0';
00904 putenv(bypassVar);
00905 free(bypassVal);
00906 }
00907 else
00908 {
00909 free(bypassVar);
00910 }
00911 }
00912 }
00913 }
00914 #endif
00915 switch (sigTag) {
00916 case RPMSIGTAG_DSA:
00917 case RPMSIGTAG_GPG:
00918 { const char *gpg_path = rpmExpand("%{?_gpg_path}", NULL);
00919
00920
00921 if (gpg_path && *gpg_path != '\0')
00922 (void) dosetenv("GNUPGHOME", gpg_path, 1);
00923
00924
00925 cmd = rpmExpand("%{?__gpg_check_password_cmd}", NULL);
00926 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00927
00928 if (!rc)
00929 rc = execve(av[0], av+1, environ);
00930
00931
00932 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "gpg",
00933 strerror(errno));
00934 } break;
00935 case RPMSIGTAG_RSA:
00936 case RPMSIGTAG_PGP5:
00937 case RPMSIGTAG_PGP:
00938 { const char *pgp_path = rpmExpand("%{?_pgp_path}", NULL);
00939 const char *path;
00940 pgpVersion pgpVer;
00941
00942 (void) dosetenv("PGPPASSFD", "3", 1);
00943
00944 if (pgp_path && *pgp_path != '\0')
00945 xx = dosetenv("PGPPATH", pgp_path, 1);
00946
00947
00948 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
00949 switch(pgpVer) {
00950 case PGP_2:
00951 cmd = rpmExpand("%{?__pgp_check_password_cmd}", NULL);
00952 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00953
00954 if (!rc)
00955 rc = execve(av[0], av+1, environ);
00956
00957 break;
00958 case PGP_5:
00959 cmd = rpmExpand("%{?__pgp5_check_password_cmd}", NULL);
00960 rc = poptParseArgvString(cmd, NULL, (const char ***)&av);
00961
00962 if (!rc)
00963 rc = execve(av[0], av+1, environ);
00964
00965 break;
00966 case PGP_UNKNOWN:
00967 case PGP_NOTDETECTED:
00968 break;
00969 }
00970 }
00971 rpmError(RPMERR_EXEC, _("Could not exec %s: %s\n"), "pgp",
00972 strerror(errno));
00973 _exit(RPMERR_EXEC);
00974 } break;
00975 default:
00976 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
00977 _exit(RPMERR_SIGGEN);
00978 break;
00979 }
00980 }
00981
00982 xx = close(passPhrasePipe[0]);
00983 xx = write(passPhrasePipe[1], passPhrase, strlen(passPhrase));
00984 xx = write(passPhrasePipe[1], "\n", 1);
00985 xx = close(passPhrasePipe[1]);
00986
00987 (void) waitpid(pid, &status, 0);
00988
00989 return ((!WIFEXITED(status) || WEXITSTATUS(status)) ? 1 : 0);
00990 }
00991
00992 char * rpmGetPassPhrase(const char * prompt, const int sigTag)
00993 {
00994 char *pass;
00995 int aok;
00996
00997 switch (sigTag) {
00998 case RPMSIGTAG_DSA:
00999 case RPMSIGTAG_GPG:
01000
01001 { const char *name = rpmExpand("%{?_gpg_name}", NULL);
01002 aok = (name && *name != '\0');
01003 name = _free(name);
01004 }
01005
01006 if (!aok) {
01007 rpmError(RPMERR_SIGGEN,
01008 _("You must set \"%%_gpg_name\" in your macro file\n"));
01009 return NULL;
01010 }
01011 pass = rpmExpand("%{_gpg_passphrase}", NULL);
01012 pass = (pass && *pass != '%') ? pass : NULL;
01013 break;
01014 case RPMSIGTAG_RSA:
01015 case RPMSIGTAG_PGP5:
01016 case RPMSIGTAG_PGP:
01017
01018 { const char *name = rpmExpand("%{?_pgp_name}", NULL);
01019 aok = (name && *name != '\0');
01020 name = _free(name);
01021 }
01022
01023 if (!aok) {
01024 rpmError(RPMERR_SIGGEN,
01025 _("You must set \"%%_pgp_name\" in your macro file\n"));
01026 return NULL;
01027 }
01028 break;
01029 default:
01030
01031
01032
01033 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
01034 return NULL;
01035 break;
01036 }
01037
01038
01039 if (pass == NULL) {
01040 pass = getpass( (prompt ? prompt : "") ) ;
01041 }
01042
01043
01044 if (checkPassPhrase(pass, sigTag))
01045 return NULL;
01046
01047 return pass;
01048 }
01049
01050 static const char * rpmSigString(rpmRC res)
01051
01052 {
01053 const char * str;
01054 switch (res) {
01055 case RPMRC_OK: str = "OK"; break;
01056 case RPMRC_FAIL: str = "BAD"; break;
01057 case RPMRC_NOKEY: str = "NOKEY"; break;
01058 case RPMRC_NOTTRUSTED: str = "NOTRUSTED"; break;
01059 default:
01060 case RPMRC_NOTFOUND: str = "UNKNOWN"; break;
01061 }
01062 return str;
01063 }
01064
01065
01066 static rpmRC
01067 verifySizeSignature(const rpmts ts, char * t)
01068
01069 {
01070 const void * sig = rpmtsSig(ts);
01071 pgpDig dig = rpmtsDig(ts);
01072 rpmRC res;
01073 int_32 size = 0x7fffffff;
01074
01075 *t = '\0';
01076 t = stpcpy(t, _("Header+Payload size: "));
01077
01078 if (sig == NULL || dig == NULL || dig->nbytes == 0) {
01079 res = RPMRC_NOKEY;
01080 t = stpcpy(t, rpmSigString(res));
01081 goto exit;
01082 }
01083
01084 memcpy(&size, sig, sizeof(size));
01085
01086 if (size != dig->nbytes) {
01087 res = RPMRC_FAIL;
01088 t = stpcpy(t, rpmSigString(res));
01089 sprintf(t, " Expected(%d) != (%d)\n", (int)size, (int)dig->nbytes);
01090 } else {
01091 res = RPMRC_OK;
01092 t = stpcpy(t, rpmSigString(res));
01093 sprintf(t, " (%d)", (int)dig->nbytes);
01094 }
01095
01096 exit:
01097 t = stpcpy(t, "\n");
01098 return res;
01099 }
01100
01101
01102
01103 static rpmRC
01104 verifyMD5Signature(const rpmts ts, char * t,
01105 DIGEST_CTX md5ctx)
01106
01107
01108 {
01109 const void * sig = rpmtsSig(ts);
01110 int_32 siglen = rpmtsSiglen(ts);
01111 pgpDig dig = rpmtsDig(ts);
01112 rpmRC res;
01113 byte * md5sum = NULL;
01114 size_t md5len = 0;
01115
01116 *t = '\0';
01117 t = stpcpy(t, _("MD5 digest: "));
01118
01119 if (md5ctx == NULL || sig == NULL || dig == NULL) {
01120 res = RPMRC_NOKEY;
01121 t = stpcpy(t, rpmSigString(res));
01122 goto exit;
01123 }
01124
01125 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01126 (void) rpmDigestFinal(rpmDigestDup(md5ctx),
01127 (void **)&md5sum, &md5len, 0);
01128 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01129
01130 if (md5len != siglen || memcmp(md5sum, sig, md5len)) {
01131 res = RPMRC_FAIL;
01132 t = stpcpy(t, rpmSigString(res));
01133 t = stpcpy(t, " Expected(");
01134 (void) pgpHexCvt(t, sig, siglen);
01135 t += strlen(t);
01136 t = stpcpy(t, ") != (");
01137 } else {
01138 res = RPMRC_OK;
01139 t = stpcpy(t, rpmSigString(res));
01140 t = stpcpy(t, " (");
01141 }
01142 (void) pgpHexCvt(t, md5sum, md5len);
01143 t += strlen(t);
01144 t = stpcpy(t, ")");
01145
01146 exit:
01147 md5sum = _free(md5sum);
01148 t = stpcpy(t, "\n");
01149 return res;
01150 }
01151
01152
01153
01161 static rpmRC
01162 verifySHA1Signature(const rpmts ts, char * t,
01163 DIGEST_CTX sha1ctx)
01164
01165
01166 {
01167 const void * sig = rpmtsSig(ts);
01168 #ifdef NOTYET
01169 int_32 siglen = rpmtsSiglen(ts);
01170 #endif
01171 pgpDig dig = rpmtsDig(ts);
01172 rpmRC res;
01173 const char * SHA1 = NULL;
01174
01175 *t = '\0';
01176 t = stpcpy(t, _("Header SHA1 digest: "));
01177
01178 if (sha1ctx == NULL || sig == NULL || dig == NULL) {
01179 res = RPMRC_NOKEY;
01180 t = stpcpy(t, rpmSigString(res));
01181 goto exit;
01182 }
01183
01184 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01185 (void) rpmDigestFinal(rpmDigestDup(sha1ctx),
01186 (void **)&SHA1, NULL, 1);
01187 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01188
01189 if (SHA1 == NULL || strlen(SHA1) != strlen(sig) || strcmp(SHA1, sig)) {
01190 res = RPMRC_FAIL;
01191 t = stpcpy(t, rpmSigString(res));
01192 t = stpcpy(t, " Expected(");
01193 t = stpcpy(t, sig);
01194 t = stpcpy(t, ") != (");
01195 } else {
01196 res = RPMRC_OK;
01197 t = stpcpy(t, rpmSigString(res));
01198 t = stpcpy(t, " (");
01199 }
01200 if (SHA1)
01201 t = stpcpy(t, SHA1);
01202 t = stpcpy(t, ")");
01203
01204 exit:
01205 SHA1 = _free(SHA1);
01206 t = stpcpy(t, "\n");
01207 return res;
01208 }
01209
01210
01216 static inline unsigned char nibble(char c)
01217
01218 {
01219 if (c >= '0' && c <= '9')
01220 return (c - '0');
01221 if (c >= 'A' && c <= 'F')
01222 return (c - 'A') + 10;
01223 if (c >= 'a' && c <= 'f')
01224 return (c - 'a') + 10;
01225 return 0;
01226 }
01227
01228
01236 static rpmRC
01237 verifyPGPSignature(rpmts ts, char * t,
01238 DIGEST_CTX md5ctx)
01239
01240
01241 {
01242 const void * sig = rpmtsSig(ts);
01243 #ifdef NOTYET
01244 int_32 siglen = rpmtsSiglen(ts);
01245 #endif
01246 int_32 sigtag = rpmtsSigtag(ts);
01247 pgpDig dig = rpmtsDig(ts);
01248 pgpDigParams sigp = rpmtsSignature(ts);
01249 rpmRC res;
01250 int xx;
01251
01252 *t = '\0';
01253 t = stpcpy(t, _("V3 RSA/MD5 signature: "));
01254
01255 if (md5ctx == NULL || sig == NULL || dig == NULL || sigp == NULL) {
01256 res = RPMRC_NOKEY;
01257 goto exit;
01258 }
01259
01260
01261 if (!(sigtag == RPMSIGTAG_PGP
01262 && sigp->pubkey_algo == PGPPUBKEYALGO_RSA
01263 && sigp->hash_algo == PGPHASHALGO_MD5))
01264 {
01265 res = RPMRC_NOKEY;
01266 goto exit;
01267 }
01268
01269 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01270 { DIGEST_CTX ctx = rpmDigestDup(md5ctx);
01271 byte signhash16[2];
01272 const char * s;
01273
01274 if (sigp->hash != NULL)
01275 xx = rpmDigestUpdate(ctx, sigp->hash, sigp->hashlen);
01276
01277 #ifdef NOTYET
01278 if (sigp->sigtype == 4) {
01279 int nb = dig->nbytes + sigp->hashlen;
01280 byte trailer[6];
01281 nb = htonl(nb);
01282 trailer[0] = 0x4;
01283 trailer[1] = 0xff;
01284 memcpy(trailer+2, &nb, sizeof(nb));
01285 xx = rpmDigestUpdate(ctx, trailer, sizeof(trailer));
01286 }
01287 #endif
01288
01289 xx = rpmDigestFinal(ctx, (void **)&dig->md5, &dig->md5len, 1);
01290 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), sigp->hashlen);
01291
01292
01293 s = dig->md5;
01294 signhash16[0] = (nibble(s[0]) << 4) | nibble(s[1]);
01295 signhash16[1] = (nibble(s[2]) << 4) | nibble(s[3]);
01296 if (memcmp(signhash16, sigp->signhash16, sizeof(signhash16))) {
01297 res = RPMRC_FAIL;
01298 goto exit;
01299 }
01300
01301 }
01302
01303 { const char * prefix = "3020300c06082a864886f70d020505000410";
01304 unsigned int nbits = 1024;
01305 unsigned int nb = (nbits + 7) >> 3;
01306 const char * hexstr;
01307 char * tt;
01308
01309 hexstr = tt = xmalloc(2 * nb + 1);
01310 memset(tt, 'f', (2 * nb));
01311 tt[0] = '0'; tt[1] = '0';
01312 tt[2] = '0'; tt[3] = '1';
01313 tt += (2 * nb) - strlen(prefix) - strlen(dig->md5) - 2;
01314 *tt++ = '0'; *tt++ = '0';
01315 tt = stpcpy(tt, prefix);
01316 tt = stpcpy(tt, dig->md5);
01317
01318 mpnzero(&dig->rsahm); mpnsethex(&dig->rsahm, hexstr);
01319
01320 hexstr = _free(hexstr);
01321
01322 }
01323
01324
01325 res = rpmtsFindPubkey(ts);
01326 if (res != RPMRC_OK)
01327 goto exit;
01328
01329 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01330 #if HAVE_BEECRYPT_API_H
01331 xx = rsavrfy(&dig->rsa_pk.n, &dig->rsa_pk.e, &dig->rsahm, &dig->c);
01332 #else
01333 xx = rsavrfy(&dig->rsa_pk, &dig->rsahm, &dig->c);
01334 #endif
01335 if (xx)
01336 res = RPMRC_OK;
01337 else
01338 res = RPMRC_FAIL;
01339 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01340
01341 exit:
01342 t = stpcpy(t, rpmSigString(res));
01343 if (sigp != NULL) {
01344 t = stpcpy(t, ", key ID ");
01345 (void) pgpHexCvt(t, sigp->signid+4, sizeof(sigp->signid)-4);
01346 t += strlen(t);
01347 }
01348 t = stpcpy(t, "\n");
01349 return res;
01350 }
01351
01352
01360
01361 static rpmRC
01362 verifyGPGSignature(rpmts ts, char * t,
01363 DIGEST_CTX sha1ctx)
01364
01365
01366 {
01367 const void * sig = rpmtsSig(ts);
01368 #ifdef NOTYET
01369 int_32 siglen = rpmtsSiglen(ts);
01370 #endif
01371 int_32 sigtag = rpmtsSigtag(ts);
01372 pgpDig dig = rpmtsDig(ts);
01373 pgpDigParams sigp = rpmtsSignature(ts);
01374 rpmRC res;
01375 int xx;
01376
01377 *t = '\0';
01378 if (dig != NULL && dig->hdrsha1ctx == sha1ctx)
01379 t = stpcpy(t, _("Header "));
01380 t = stpcpy(t, _("V3 DSA signature: "));
01381
01382 if (sha1ctx == NULL || sig == NULL || dig == NULL || sigp == NULL) {
01383 res = RPMRC_NOKEY;
01384 goto exit;
01385 }
01386
01387
01388 if (!((sigtag == RPMSIGTAG_GPG || sigtag == RPMSIGTAG_DSA)
01389 && sigp->pubkey_algo == PGPPUBKEYALGO_DSA
01390 && sigp->hash_algo == PGPHASHALGO_SHA1))
01391 {
01392 res = RPMRC_NOKEY;
01393 goto exit;
01394 }
01395
01396 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_DIGEST), 0);
01397 { DIGEST_CTX ctx = rpmDigestDup(sha1ctx);
01398 byte signhash16[2];
01399
01400 if (sigp->hash != NULL)
01401 xx = rpmDigestUpdate(ctx, sigp->hash, sigp->hashlen);
01402
01403 #ifdef NOTYET
01404 if (sigp->sigtype == 4) {
01405 int nb = dig->nbytes + sigp->hashlen;
01406 byte trailer[6];
01407 nb = htonl(nb);
01408 trailer[0] = 0x4;
01409 trailer[1] = 0xff;
01410 memcpy(trailer+2, &nb, sizeof(nb));
01411 xx = rpmDigestUpdate(ctx, trailer, sizeof(trailer));
01412 }
01413 #endif
01414 xx = rpmDigestFinal(ctx, (void **)&dig->sha1, &dig->sha1len, 1);
01415 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_DIGEST), sigp->hashlen);
01416
01417 mpnzero(&dig->hm); mpnsethex(&dig->hm, dig->sha1);
01418
01419
01420 signhash16[0] = (*dig->hm.data >> 24) & 0xff;
01421 signhash16[1] = (*dig->hm.data >> 16) & 0xff;
01422 if (memcmp(signhash16, sigp->signhash16, sizeof(signhash16))) {
01423 res = RPMRC_FAIL;
01424 goto exit;
01425 }
01426 }
01427
01428
01429 res = rpmtsFindPubkey(ts);
01430 if (res != RPMRC_OK)
01431 goto exit;
01432
01433 (void) rpmswEnter(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01434 if (dsavrfy(&dig->p, &dig->q, &dig->g,
01435 &dig->hm, &dig->y, &dig->r, &dig->s))
01436 res = RPMRC_OK;
01437 else
01438 res = RPMRC_FAIL;
01439 (void) rpmswExit(rpmtsOp(ts, RPMTS_OP_SIGNATURE), 0);
01440
01441 exit:
01442 t = stpcpy(t, rpmSigString(res));
01443 if (sigp != NULL) {
01444 t = stpcpy(t, ", key ID ");
01445 (void) pgpHexCvt(t, sigp->signid+4, sizeof(sigp->signid)-4);
01446 t += strlen(t);
01447 }
01448 t = stpcpy(t, "\n");
01449 return res;
01450 }
01451
01452
01453 rpmRC
01454 rpmVerifySignature(const rpmts ts, char * result)
01455 {
01456 const void * sig = rpmtsSig(ts);
01457 int_32 siglen = rpmtsSiglen(ts);
01458 int_32 sigtag = rpmtsSigtag(ts);
01459 pgpDig dig = rpmtsDig(ts);
01460 rpmRC res;
01461
01462 if (sig == NULL || siglen <= 0 || dig == NULL) {
01463 sprintf(result, _("Verify signature: BAD PARAMETERS\n"));
01464 return RPMRC_NOTFOUND;
01465 }
01466
01467 switch (sigtag) {
01468 case RPMSIGTAG_SIZE:
01469 res = verifySizeSignature(ts, result);
01470 break;
01471 case RPMSIGTAG_MD5:
01472 res = verifyMD5Signature(ts, result, dig->md5ctx);
01473 break;
01474 case RPMSIGTAG_SHA1:
01475 res = verifySHA1Signature(ts, result, dig->hdrsha1ctx);
01476 break;
01477 case RPMSIGTAG_RSA:
01478 case RPMSIGTAG_PGP5:
01479 case RPMSIGTAG_PGP:
01480 res = verifyPGPSignature(ts, result, dig->md5ctx);
01481 break;
01482 case RPMSIGTAG_DSA:
01483 res = verifyGPGSignature(ts, result, dig->hdrsha1ctx);
01484 break;
01485 case RPMSIGTAG_GPG:
01486 res = verifyGPGSignature(ts, result, dig->sha1ctx);
01487 break;
01488 case RPMSIGTAG_LEMD5_1:
01489 case RPMSIGTAG_LEMD5_2:
01490 sprintf(result, _("Broken MD5 digest: UNSUPPORTED\n"));
01491 res = RPMRC_NOTFOUND;
01492 break;
01493 default:
01494 sprintf(result, _("Signature: UNKNOWN (%d)\n"), sigtag);
01495 res = RPMRC_NOTFOUND;
01496 break;
01497 }
01498 return res;
01499 }