diff options
Diffstat (limited to 'methods')
| -rw-r--r-- | methods/gpgv.cc | 49 | ||||
| -rw-r--r-- | methods/sqv.cc | 23 |
2 files changed, 4 insertions, 68 deletions
diff --git a/methods/gpgv.cc b/methods/gpgv.cc index 1a6356dee..ecdbe5898 100644 --- a/methods/gpgv.cc +++ b/methods/gpgv.cc @@ -121,10 +121,6 @@ class GPGVMethod : public aptMethod vector<string> const &keyFpts, vector<string> const &keyFiles, SignersStorage &Signers); - string VerifyGetSignersWithLegacy(const char *file, const char *outfile, - vector<string> const &keyFpts, - vector<string> const &keyFiles, - SignersStorage &Signers); protected: bool URIAcquire(std::string const &Message, FetchItem *Itm) override; @@ -482,49 +478,6 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile, else return _("Unknown error executing gpgv"); } -string GPGVMethod::VerifyGetSignersWithLegacy(const char *file, const char *outfile, - vector<string> const &keyFpts, - vector<string> const &keyFiles, - SignersStorage &Signers) -{ - string const msg = VerifyGetSigners(file, outfile, keyFpts, keyFiles, Signers); - if (_error->PendingError()) - return msg; - - // Bad signature always remains bad, no need to retry against trusted.gpg - if (!Signers.Bad.empty()) - return msg; - - // We do not have a key file pinned, did not find a good signature, but found - // missing keys - let's retry with trusted.gpg - if (keyFiles.empty() && Signers.Valid.empty() && !Signers.NoPubKey.empty()) - { - std::vector<std::string> legacyKeyFiles{_config->FindFile("Dir::Etc::trusted")}; - if (legacyKeyFiles[0].empty()) - return msg; - if (DebugEnabled()) - std::clog << "Retrying against " << legacyKeyFiles[0] << "\n"; - - SignersStorage legacySigners; - - string const legacyMsg = VerifyGetSigners(file, outfile, keyFpts, legacyKeyFiles, legacySigners); - if (_error->PendingError()) - return legacyMsg; - // Hooray, we found a key apparently, something verified as good or bad - if (!legacySigners.Valid.empty() || !legacySigners.Bad.empty()) - { - std::string warning; - strprintf(warning, - _("Key is stored in legacy trusted.gpg keyring (%s). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details."), - legacyKeyFiles[0].c_str()); - Warning(std::move(warning)); - Signers = std::move(legacySigners); - return legacyMsg; - } - - } - return msg; -} static std::string GenerateKeyFile(std::string const key) { FileFd fd; @@ -563,7 +516,7 @@ bool GPGVMethod::URIAcquire(std::string const &Message, FetchItem *Itm) } // Run gpgv on file, extract contents and get the key ID of the signer - string const msg = VerifyGetSignersWithLegacy(Path.c_str(), Itm->DestFile.c_str(), keyFpts, keyFiles, Signers); + string const msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), keyFpts, keyFiles, Signers); if (_error->PendingError()) return false; diff --git a/methods/sqv.cc b/methods/sqv.cc index ce7e36657..9dbe75994 100644 --- a/methods/sqv.cc +++ b/methods/sqv.cc @@ -133,6 +133,8 @@ bool SQVMethod::VerifyGetSigners(const char *file, const char *outfile, if (keyFiles.empty()) { auto Parts = GetListOfFilesInDir(_config->FindDir("Dir::Etc::TrustedParts"), std::vector<std::string>{"gpg", "asc"}, true); + if (auto trusted = _config->FindFile("Dir::Etc::Trusted"); not trusted.empty()) + Parts.push_back(trusted); for (auto &Part : Parts) { if (Debug) @@ -298,27 +300,8 @@ bool SQVMethod::URIAcquire(std::string const &Message, FetchItem *Itm) // Run sqv on file, extract contents and get the key ID of the signer VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), keyFiles, Signers); - if (_error->PendingError()) - { - // Legacy fallback to trusted.gpg - auto trusted = _config->FindFile("Dir::Etc::Trusted"); - _error->PushToStack(); - VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), {trusted}, Signers); - bool error = _error->PendingError(); - _error->RevertToStack(); - if (error) - return false; - - _error->Discard(); - std::string warning; - strprintf(warning, - _("Key is stored in legacy trusted.gpg keyring (%s). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details."), - trusted.c_str()); - Warning(std::move(warning)); - } - if (Signers.empty()) - return _error->Error("No good signature"); + return _error->PendingError() ? false : _error->Error("No good signature"); if (not keyFpts.empty()) { |