RPM Package Manager, CVS Repository
http://rpm5.org/cvs/
____________________________________________________________________________
Server: rpm5.org Name: Jeff Johnson
Root: /v/rpm/cvs Email: [EMAIL PROTECTED]
Module: rpm Date: 13-Jun-2007 02:59:32
Branch: rpm-4_5 Handle: 2007061301593001
Modified files: (Branch: rpm-4_5)
rpm CHANGES
rpm/lib package.c rpmchecksig.c
Log:
- skip packages/headers with unverifiable signatures.
Summary:
Revision Changes Path
1.1360.2.17 +1 -0 rpm/CHANGES
2.134.2.1 +20 -18 rpm/lib/package.c
1.114.2.1 +4 -3 rpm/lib/rpmchecksig.c
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: rpm/CHANGES
============================================================================
$ cvs diff -u -r1.1360.2.16 -r1.1360.2.17 CHANGES
--- rpm/CHANGES 10 Jun 2007 23:09:05 -0000 1.1360.2.16
+++ rpm/CHANGES 13 Jun 2007 00:59:30 -0000 1.1360.2.17
@@ -23,6 +23,7 @@
- install rpm into /usr/bin, not /bin.
- eliminate rpm executable helpers.
- update library version.
+ - skip packages/headers with unverifiable signatures.
4.4.8 -> 4.4.9:
- start rpm-4.4.9 devel.
@@ .
patch -p0 <<'@@ .'
Index: rpm/lib/package.c
============================================================================
$ cvs diff -u -r2.134 -r2.134.2.1 package.c
--- rpm/lib/package.c 25 May 2007 17:36:02 -0000 2.134
+++ rpm/lib/package.c 13 Jun 2007 00:59:31 -0000 2.134.2.1
@@ -541,11 +541,12 @@
/* Parse the parameters from the OpenPGP packets that will be needed. */
xx = pgpPrtPkts(sig, info->count, dig, (_print_pkts & rpmIsDebug()));
if (dig->signature.version != 3 && dig->signature.version != 4) {
- rpmMessage(RPMMESS_WARNING,
- _("only V3 and V4 signatures can be verified, skipping V%u
signature\n"),
+ rpmMessage(RPMMESS_ERROR,
+ _("skipping header with unverifiable V%u signature\n"),
dig->signature.version);
rpmtsCleanDig(ts);
- goto verifyinfo_exit;
+ rc = RPMRC_FAIL;
+ goto exit;
}
ildl[0] = htonl(ril);
@@ -581,11 +582,12 @@
/* Parse the parameters from the OpenPGP packets that will be needed. */
xx = pgpPrtPkts(sig, info->count, dig, (_print_pkts & rpmIsDebug()));
if (dig->signature.version != 3 && dig->signature.version != 4) {
- rpmMessage(RPMMESS_WARNING,
- _("only V3 and V4 signatures can be verified, skipping V%u
signature\n"),
+ rpmMessage(RPMMESS_ERROR,
+ _("skipping header with unverifiable V%u signature\n"),
dig->signature.version);
rpmtsCleanDig(ts);
- goto verifyinfo_exit;
+ rc = RPMRC_FAIL;
+ goto exit;
}
/[EMAIL PROTECTED]@*/
case RPMTAG_SHA1HEADER:
@@ -925,10 +927,10 @@
/* Parse the parameters from the OpenPGP packets that will be needed. */
xx = pgpPrtPkts(sig, siglen, dig, (_print_pkts & rpmIsDebug()));
if (dig->signature.version != 3 && dig->signature.version != 4) {
- rpmMessage(RPMMESS_WARNING,
- _("only V3 and V4 signatures can be verified, skipping V%u
signature\n"),
- dig->signature.version);
- rc = RPMRC_OK; /* XXX return header w/o verify */
+ rpmMessage(RPMMESS_ERROR,
+ _("skipping package %s with unverifiable V%u signature\n"),
+ fn, dig->signature.version);
+ rc = RPMRC_FAIL;
goto exit;
}
{ void * uh = NULL;
@@ -951,10 +953,10 @@
/* Parse the parameters from the OpenPGP packets that will be needed. */
xx = pgpPrtPkts(sig, siglen, dig, (_print_pkts & rpmIsDebug()));
if (dig->signature.version != 3 && dig->signature.version != 4) {
- rpmMessage(RPMMESS_WARNING,
- _("only V3 and V4 signatures can be verified, skipping V%u
signature\n"),
- dig->signature.version);
- rc = RPMRC_OK; /* XXX return header w/o verify */
+ rpmMessage(RPMMESS_ERROR,
+ _("skipping package %s with unverifiable V%u signature\n"),
+ fn, dig->signature.version);
+ rc = RPMRC_FAIL;
goto exit;
}
/[EMAIL PROTECTED]@*/
@@ -983,10 +985,10 @@
xx = pgpPrtPkts(sig, siglen, dig, (_print_pkts & rpmIsDebug()));
if (dig->signature.version != 3 && dig->signature.version != 4) {
- rpmMessage(RPMMESS_WARNING,
- _("only V3 and V4 signatures can be verified, skipping V%u
signature\n"),
- dig->signature.version);
- rc = RPMRC_OK; /* XXX return header w/o verify */
+ rpmMessage(RPMMESS_ERROR,
+ _("skipping package %s with unverifiable V%u signature\n"),
+ fn, dig->signature.version);
+ rc = RPMRC_FAIL;
goto exit;
}
/[EMAIL PROTECTED]@*/
@@ .
patch -p0 <<'@@ .'
Index: rpm/lib/rpmchecksig.c
============================================================================
$ cvs diff -u -r1.114 -r1.114.2.1 rpmchecksig.c
--- rpm/lib/rpmchecksig.c 25 May 2007 17:36:02 -0000 1.114
+++ rpm/lib/rpmchecksig.c 13 Jun 2007 00:59:31 -0000 1.114.2.1
@@ -867,9 +867,10 @@
if (sigp->version != 3 && sigp->version != 4) {
rpmError(RPMERR_SIGVFY,
- _("only V3 or V4 signatures can be verified, skipping V%u
signature\n"),
- sigp->version);
- continue;
+ _("skipping package %s with unverifiable V%u signature\n"),
+ fn, sigp->version);
+ res++;
+ goto exit;
}
/[EMAIL PROTECTED]@*/ break;
case RPMSIGTAG_SHA1:
@@ .
______________________________________________________________________
RPM Package Manager http://rpm5.org
CVS Sources Repository [email protected]
