apt/apt-pkg, branch 2.9.16Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=2.9.162024-11-29T08:38:00ZAvoid extension check for .gpg2024-11-29T08:38:00ZJulian Andres Klodejulian.klode@canonical.com2024-11-29T08:38:00Zurn:sha1:00b4aa9c1d7f50a6e45c72e7a7c417975932cabb
We only ever documented .gpg and .asc and have ensured that
only such files exist in the keyring, but people can set the
Signed-By option to keys with any random extension, as that
was not validated before by apt-key.
This doesn't change the behavior for trusted.gpg.d: We filter
the directory listing and only look at .gpg and .asc files.
Closes: #1088656
Detect working gpgv using gpgv --dump-options2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-28T08:55:57Zurn:sha1:86f8353ce7a343db7b19422db0d37379ac45ff4e
This gains us support for not using an absolute path, which
is nice, and we can now cache the invocation across fork() in
the method.
Still keep preferring absolute paths, this avoids execvp() having
to iterate the path and reduces bug potential with custom gpgv in
/usr/local.
Fix the last entry in the list of gpgvs to say gpgv1
fileutl: Use execvp() in Popen() instead of execv()2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-28T08:49:58Zurn:sha1:7038347919d59b2f96a8f51f994889a5b4d66cbagpgv: Add direct support for --assert-pubkey-algo2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-23T18:50:44Zurn:sha1:0496bc63a3ad1dcbc41d20225c6a0d50fbcf101dDirectly call gpgv instead of apt-key2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-23T18:59:24Zurn:sha1:325b0c89358dae042ebfe0ba6dcbcc43253927a6gpgv: Verify keyrings and dearmor outside apt-key2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-23T18:41:45Zurn:sha1:623bc8a69d0e89c0f18305403741af4fda8d87bfstrutl: Add Base64Decode2024-11-28T09:17:21ZJulian Andres Klodejak@debian.org2024-11-23T18:32:06Zurn:sha1:62cc071f88cb33c1f6213c9dbd54a10135c5ad34
Lifted from the dpkg mtree code that mjg59 submitted in
https://lists.debian.org/debian-dpkg/2018/05/msg00005.html
Which as dpkg is GPL-2.0+ also is GPL-2.0+
gpgv: Use std::string instead of const char *2024-11-28T09:17:21ZJulian Andres Klodejak@debian.org2024-11-23T18:13:07Zurn:sha1:0211fd6451bd67e5c590ac89c8696310ac8dd78c
This is a bit more overhead here, but if we need to build temporary
strings this is a lot cleaner.
gpgv: Explictly pass all the keyrings to gpgv from apt2024-11-28T09:17:21ZJulian Andres Klodejak@debian.org2024-11-23T15:50:25Zurn:sha1:d8d3e51ff18ab75243931c27920191685c19b981Do not implode key file name vector for calling gpgv2024-11-28T09:17:21ZJulian Andres Klodejak@debian.org2024-11-23T16:45:11Zurn:sha1:0e69c1fa5b8a4a1237933fa47113ea839a66f8a0
Converting it to a comma-separated string and back loses precision.