apt/apt-pkg/contrib/gpgv.cc, branch 2.9.17 Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.9.17 2024-12-07T14:14:33Z gpgv: Drop references to apt-key 2024-12-07T14:14:33Z Julian Andres Klode julian.klode@canonical.com 2024-12-04T10:12:34Z urn:sha1:2f9775ed580656214e62e7916ee896776fabc9e7 gpgv: Merge all keyrings into a single one again 2024-12-04T09:14:44Z Julian Andres Klode julian.klode@canonical.com 2024-12-04T08:56:58Z urn:sha1:48e5af8b5df391e62657b604b2b54885f7ce1c02 gpgv is quite picky, it takes at most 40 keyrings but it also doesn't even take keyrings with : in the name, generating an ERROR message instead. So instead let's always merge the configured keyrings for the source into a single one. While we are at it, since we are merging now, let's also add some rudimentary error checking to what we write into the merged keyring: If copying into it fails, we should abort. Reported-by: SuShY on IRC Avoid extension check for .gpg 2024-11-29T08:38:00Z Julian Andres Klode julian.klode@canonical.com 2024-11-29T08:38:00Z urn:sha1:00b4aa9c1d7f50a6e45c72e7a7c417975932cabb We only ever documented .gpg and .asc and have ensured that only such files exist in the keyring, but people can set the Signed-By option to keys with any random extension, as that was not validated before by apt-key. This doesn't change the behavior for trusted.gpg.d: We filter the directory listing and only look at .gpg and .asc files. Closes: #1088656 Detect working gpgv using gpgv --dump-options 2024-11-28T18:01:36Z Julian Andres Klode jak@debian.org 2024-11-28T08:55:57Z urn:sha1:86f8353ce7a343db7b19422db0d37379ac45ff4e This gains us support for not using an absolute path, which is nice, and we can now cache the invocation across fork() in the method. Still keep preferring absolute paths, this avoids execvp() having to iterate the path and reduces bug potential with custom gpgv in /usr/local. Fix the last entry in the list of gpgvs to say gpgv1 gpgv: Add direct support for --assert-pubkey-algo 2024-11-28T18:01:36Z Julian Andres Klode jak@debian.org 2024-11-23T18:50:44Z urn:sha1:0496bc63a3ad1dcbc41d20225c6a0d50fbcf101d Directly call gpgv instead of apt-key 2024-11-28T18:01:36Z Julian Andres Klode jak@debian.org 2024-11-23T18:59:24Z urn:sha1:325b0c89358dae042ebfe0ba6dcbcc43253927a6 gpgv: Verify keyrings and dearmor outside apt-key 2024-11-28T18:01:36Z Julian Andres Klode jak@debian.org 2024-11-23T18:41:45Z urn:sha1:623bc8a69d0e89c0f18305403741af4fda8d87bf gpgv: Use std::string instead of const char * 2024-11-28T09:17:21Z Julian Andres Klode jak@debian.org 2024-11-23T18:13:07Z urn:sha1:0211fd6451bd67e5c590ac89c8696310ac8dd78c This is a bit more overhead here, but if we need to build temporary strings this is a lot cleaner. gpgv: Explictly pass all the keyrings to gpgv from apt 2024-11-28T09:17:21Z Julian Andres Klode jak@debian.org 2024-11-23T15:50:25Z urn:sha1:d8d3e51ff18ab75243931c27920191685c19b981 Do not implode key file name vector for calling gpgv 2024-11-28T09:17:21Z Julian Andres Klode jak@debian.org 2024-11-23T16:45:11Z urn:sha1:0e69c1fa5b8a4a1237933fa47113ea839a66f8a0 Converting it to a comma-separated string and back loses precision.