Changeset 2188 in ProjectBuilder for devel/pb-modules

Timestamp:

Mar 3, 2017, 4:07:33 AM (8 years ago)

Author:

Bruno Cornec

Message:

Add support for additional signed deb repositories

File:

• devel/pb-modules/lib/ProjectBuilder/Distribution.pm (modified) (1 diff)

devel/pb-modules/lib/ProjectBuilder/Distribution.pm

@@ -677 +677 @@
             my $dest = "/etc/apt/sources.list.d/$bn";
             return if (pb_distro_compare_repo("$ENV{'PBTMP'}/$bn",$dest) == 1);
-            pb_system("sudo mv $ENV{'PBTMP'}/$bn /etc/apt/sources.list.d","Adding apt repository");
+            pb_system("sudo mv $ENV{'PBTMP'}/$bn $dest","Adding apt repository $dest");
+            # Check whether GPG keys for this repo are already known and if
+            # not add them
+            open(REPO,"$dest") || confess "Unable to open $dest";
+            my $debrepo;
+            while (<REPO>) {
+                if (/^deb\s/) {
+                    $debrepo = $_;
+                    chomp($debrepo);
+                    $debrepo =~ s|^deb ([^\s]+)\s([^\s]+)\s([^\s]+)|$1/dists/$2|;
+                    last;
+                }
+            }
+            close(REPO);
+            return if (not defined $debrepo);
+
+            pb_system("wget -O $ENV{'PBTMP'}/Release $debrepo/Release","Downloading $debrepo/Release");
+            pb_system("wget -O $ENV{'PBTMP'}/Release.gpg $debrepo/Release.gpg","Downloading $debrepo/Release.gpg");
+            my $signature;
+            open(SIGN,"LANGUAGE=C LANG=C gpg --verify $ENV{'PBTMP'}/Release.gpg $ENV{'PBTMP'}/Release 2>&1 |") || confess "Unable to verify GPG signature from Release.gpg\n";
+            while(<SIGN>) {
+                chomp();
+                if (/^gpg: .*key ID/) {
+                    $signature = $_;
+                    $signature =~ s/^gpg: .*key ID ([A-Z0-9]+)/$1/;
+                    #TODO: create a pbkeyserver conf var for that
+                    pb_system("gpg --recv-keys --keyserver hkp://pgp.mit.edu $signature","Importing GPG signature for $signature");
+                    $signature = undef;
+                    last;
+                }
+            }
+            close(SIGN);
+            open(SIGN,"LANGUAGE=C LANG=C gpg --verify $ENV{'PBTMP'}/Release.gpg $ENV{'PBTMP'}/Release 2>&1 |") || confess "Unable to verify GPG signature from $debrepo/Release.gpg\n";
+            while(<SIGN>) {
+                chomp();
+                if (/^gpg: Good signature/) {
+                    $signature = $_;
+                    $signature =~ s/^gpg: Good signature from "([^\"]+)"/$1/;
+                }
+            }
+            close(SIGN);
+
+            return if (not defined $signature);
+            pb_log(3, "GnuPG repo verify returned: $signature\n");
+            unlink("$ENV{'PBTMP'}/apt.sig");
+            pb_system("gpg -a --export -o $ENV{'PBTMP'}/apt.sig \'$signature\'","Exporting GnuPG signature of $signature");
+            pb_system("sudo apt-key add $ENV{'PBTMP'}/apt.sig","Adding GnuPG signature of $signature to APT key ring");
             pb_system("sudo apt-get update","Updating apt repository");
         } else {