warn if clearsigned file has ignored content parts

Clearsigned files like InRelease, .dsc, .changes and co can potentially
include unsigned or additional messages blocks ignored by gpg in
verification, but a potential source of trouble in our own parsing
attempts – and an unneeded risk as the usecases for the clearsigned
files we deal with do not reasonably include unsigned parts (like emails
or some such).

This commit changes the silent ignoring to warnings for now to get an
impression on how widespread unintended unsigned parts are, but
eventually we want to turn these into hard errors.

1 files changed, 17 insertions, 2 deletions

diff --git a/apt-pkg/contrib/gpgv.cc b/apt-pkg/contrib/gpgv.cc
index b6c4b6e08..0878a7ffb 100644
--- a/apt-pkg/contrib/gpgv.cc
+++ b/apt-pkg/contrib/gpgv.cc
@@ -145,7 +145,6 @@ void ExecGPGV(std::string const &File, std::string const &FileGPG,
    }
 
    enum  { DETACHED, CLEARSIGNED } releaseSignature = (FileGPG != File) ? DETACHED : CLEARSIGNED;
-   std::vector<std::string> dataHeader;
    char * sig = NULL;
    char * data = NULL;
    char * conf = nullptr;
@@ -204,7 +203,7 @@ void ExecGPGV(std::string const &File, std::string const &FileGPG,
       message.OpenDescriptor(dataFd, FileFd::WriteOnly, true);
 
       if (signature.Failed() == true || message.Failed() == true ||
-	    SplitClearSignedFile(File, &message, &dataHeader, &signature) == false)
+	    SplitClearSignedFile(File, &message, nullptr, &signature) == false)
       {
 	 apt_error(std::cerr, statusfd, fd, "Splitting up %s into data and signature failed", File.c_str());
 	 local_exit(112);
@@ -313,6 +312,8 @@ bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
    bool skip_until_empty_line = false;
    bool found_signature = false;
    bool first_line = true;
+   bool signed_message_not_on_first_line = false;
+   bool found_garbage = false;
 
    char *buf = NULL;
    size_t buf_size = 0;
@@ -327,6 +328,8 @@ bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
 	    found_message_start = true;
 	    skip_until_empty_line = true;
 	 }
+	 else
+	    signed_message_not_on_first_line = found_garbage = true;
       }
       else if (skip_until_empty_line == true)
       {
@@ -364,6 +367,8 @@ bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
 	    if (ContentFile != NULL)
 	       ContentFile->Write(dashfree, strlen(dashfree));
 	 }
+	 else
+	    found_garbage = true;
       }
       else if (found_signature == true)
       {
@@ -376,6 +381,8 @@ bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
 	    found_signature = false; // look for other signatures
       }
       // all the rest is whitespace, unsigned garbage or additional message blocks we ignore
+      else
+	 found_garbage = true;
    }
    fclose(in);
    if (buf != NULL)
@@ -387,6 +394,14 @@ bool SplitClearSignedFile(std::string const &InFile, FileFd * const ContentFile,
    if (ContentFile != nullptr)
       ContentFile->Flush();
 
+   if (found_message_start)
+   {
+      if (signed_message_not_on_first_line)
+	 _error->Warning("Clearsigned file '%s' does not start with a signed message block.", InFile.c_str());
+      else if (found_garbage)
+	 _error->Warning("Clearsigned file '%s' contains unsigned lines.", InFile.c_str());
+   }
+
    // An error occured during reading - propagate it up
    bool const hasErrored = _error->PendingError();
    _error->MergeWithStack();