| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This implements a simple check where we first run `sqv` with
`--policy-as-of` 1 year in the future. If the file is validly
signed one year in the future, it is validly signed now.
If the file is not validly signed 1 year in the future, we check
if it is validly signed now, and otherwise print an error message.
The --policy-as-of feature was added in sqv 1.3.0, hence we add a
version requirement to the dependency.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
This should remain a warning case for now. So push the errors
to a stack and see if we can find any file.
Explictly warn again if Dir::Etc::trusted is set, as it is like
_super_ deprecated.
Reported-By: Cyril Brulebois <kibi@debian.org> in Bug#1032131
|
| |
|
|
|
|
|
|
|
|
| |
This warning has been superseded by the missing sources.list
notice (which will also become a warning shortly)
Adjust the sqv exit to avoid introducing a new spurious
"No good signature" that we did not reach before.
moo
|
| |
|
|
| |
References: a00fbbdb28cc31e78882301c2efe7218583ab4cb
|
| |
|
|
|
|
|
|
|
| |
We were rather inconsistent in using it and as our public headers
contain deduction guides (a c++17 feature) it seems silly to try to hide
a c++11 feature in a macro, so lets stop this charade and drop the
macro and while we are changing all these lines lets apply [[nodiscard]]
(another c++17 feature) and other suggestions from clang-tidy and
formatting for a little more consistency.
|
| |
|
|
|
|
|
|
|
|
|
| |
We inadvertently did not discard pending errors when the
fallback to Dir::Etc::trusted succeeded, do so.
Also add some quick safety checks to make sure we enter the
verification in a good state, and that if somehow errors are
pending after a verification we return false.
Closes: #1091679
|
|
|
The new sqv method uses sequoia's sqv tool to verify files. The
tool's interface is quite simple: It returns 0 on success, and
prints one line per good signer with the fingerprint.
sqv has a configurable crypto policy. We have defined apt-specific
override mechanisms for sequoia's standard policy, allowing both
users, distributions, and apt package to provide overrides for
Sequoia's default policy in meaningful ways.
The sqv method will be built and be the standard method for
verifying OpenPGP signatures provided that `sqv` is in the
PATH during building. It is not built if there was no sqv
at build time, so you need a rebuild to enable sqv later
on.
On the flip side, the gpgv method is always built, but it
does need to be always built: If APT::Key::GPGVCommand is
set, we need to fallback to it - this is important to
support existing users of that interface such as
mmdebstrap. Also we want to fall back to it when /usr/bin/sqv
disappears - for example in our CI :D
A couple of concessions have been made for test suite purposes:
- Failure to split a clearsigned file only shows the summary,
as the gpgv method also only showed it, and no details why
it failed.
- We write "Got GOODSIG <fingerprint>" in debug mode to mimic
the gpgv code to keep the test suite happy.
- In various places in the test suite we assert minimal output
from sqv, but sqv's human output is not intended to be stable.
This will incur additional work when it breaks. However we do
not _parse_ the output, so actual operation of apt is unaffected.
A couple of things are suboptimal here:
- We are still doing clearsigned splitting ourselves. sqv only
has support for detached signatures right now, whereas sqopv
has support for clearsigned files as well (but sqopv does not
provide any reasons for why signature verification fails or
means to set a policy).
- Deprecation of algorithms happens on a timebomb basis in
sequoia. We have no means to give users warnings ahead of
time if their configuration is outdated.
We have implemented various bits that probably should be going away:
- Fallback to trusted.gpg
This is just annoying...
- Support for fingerprints in Signed-By (no subkey matching though)
The extra work here is arguably less compared to gpgv.
- Check the keyring for correctness.
With Signed-By everywhere, we should just error out rather than
skip broken keyrings.
Moo
|
