On Mon, Dec 05, 2011 at 10:09:45AM -0600, Dan McGee wrote: > This prevents user error in adding a file generated via `gpg --sign` > rather than `--detach-sign`, for example. The same 16KiB limit is used > we use in our pacman download code. > > The section is moved above the checksum generation to avoid presenting > info messages to the user if the signature isn't valid. > > Addresses a shortcoming pointed out in FS#27453. > > Signed-off-by: Dan McGee <d...@archlinux.org> > --- > scripts/repo-add.sh.in | 19 ++++++++++++------- > 1 files changed, 12 insertions(+), 7 deletions(-) > > diff --git a/scripts/repo-add.sh.in b/scripts/repo-add.sh.in > index 5e1d770..1cde913 100644 > --- a/scripts/repo-add.sh.in > +++ b/scripts/repo-add.sh.in > @@ -245,7 +245,7 @@ db_write_entry() { > local pkgfile="$1" > local -a _groups _licenses _replaces _depends _conflicts _provides > _optdepends > local pkgname pkgver pkgdesc csize size url arch builddate packager \ > - md5sum sha256sum pgpsig > + md5sum sha256sum pgpsig pgpsigsize > > # read info from the zipped package > local line var val > @@ -284,6 +284,17 @@ db_write_entry() { > fi > fi > > + # compute base64'd PGP signature > + if [[ -f "$pkgfile.sig" ]]; then > + pgpsigsize=$(@SIZECMD@ "$pkgfile.sig") > + if [[ $pgpsigsize > 16384 ]]; then
This is a lexical comparison -- most sigs are going to fail this check. You meant to use an arithmetic context: (( pgpsigsize > 16384 )) This looks ifne otherwise. > + error "$(gettext "Invalid package signature file > '%s'.")" "$pkgfile.sig" > + return 1 > + fi > + msg2 "$(gettext "Adding package signature...")" > + pgpsig=$(openssl base64 -in "$pkgfile.sig" | tr -d '\n') > + fi > + > csize=$(@SIZECMD@ "$pkgfile") > > # compute checksums > @@ -293,12 +304,6 @@ db_write_entry() { > sha256sum="$(openssl dgst -sha256 "$pkgfile")" > sha256sum="${sha256sum##* }" > > - # compute base64'd PGP signature > - if [[ -f "$pkgfile.sig" ]]; then > - msg2 "$(gettext "Adding package signature...")" > - pgpsig=$(openssl base64 -in "$pkgfile.sig" | tr -d '\n') > - fi > - > # remove an existing entry if it exists, ignore failures > db_remove_entry "$pkgname" > > -- > 1.7.8 > >
pgpRT4mr8VKdi.pgp
Description: PGP signature