Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't allow installing packages without ARCH or OS #3478

Merged
merged 5 commits into from
Dec 3, 2024
Merged

Don't allow installing packages without ARCH or OS #3478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
51f4831
Test rpm -e gpg-pubkey
ffesti Nov 29, 2024
138f7b1
Don't allow installing packages without ARCH or OS
ffesti Nov 29, 2024
ade31e9
Add test case for missing mandatory tags
ffesti Nov 29, 2024
8425def
Don't allow installing gpg-pubkey packages
ffesti Nov 29, 2024
b6a5793
Ensure gpg-pubkey packages not having OS and ARCH
ffesti Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions lib/keystore.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,11 +247,17 @@ rpmRC keystore_rpmdb::load_keys(rpmtxn txn, rpmKeyring keyring)
while ((h = rpmdbNextIterator(mi)) != NULL) {
struct rpmtd_s pubkeys;
const char *key;
char *nevr = headerGetAsString(h, RPMTAG_NEVR);

if (!headerGet(h, RPMTAG_PUBKEYS, &pubkeys, HEADERGET_MINMEM))
continue;
/* don't allow normal packages named gpg-pubkey */
if (headerIsEntry(h, RPMTAG_ARCH) || headerIsEntry(h, RPMTAG_OS) ||
!headerGet(h, RPMTAG_PUBKEYS, &pubkeys, HEADERGET_MINMEM))
{
rpmlog(RPMLOG_WARNING, _("%s is not a valid public key\n"), nevr);
free(nevr);
continue;
}

char *nevr = headerGetAsString(h, RPMTAG_NEVR);
while ((key = rpmtdNextString(&pubkeys))) {
uint8_t *pkt;
size_t pktlen;
Expand Down
13 changes: 11 additions & 2 deletions lib/rpmte.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,9 +159,18 @@ static int addTE(rpmte p, Header h, fnpyKey key, rpmRelocation * relocs)
p->arch = headerGetAsString(h, RPMTAG_ARCH);
p->os = headerGetAsString(h, RPMTAG_OS);

/* gpg-pubkey's dont have os or arch (sigh), for others they are required */
if (!rstreq(p->name, "gpg-pubkey") && (p->arch == NULL || p->os == NULL))
if (p->arch == NULL || p->os == NULL) {
if (p->type == TR_REMOVED && rstreq(p->name, "gpg-pubkey")) {
rpmlog(RPMLOG_WARNING, _("erasing gpg-pubkey packages is deprecated; use rpmkeys --delete %s\n"), p->version);
} else {
goto exit;
}
}

if (p->type != TR_REMOVED && rstreq(p->name, "gpg-pubkey")) {
rpmlog(RPMLOG_ERR, _("public keys can not be installed as gpg-pubkey packages; use rpmkeys --import <keyfile> for that\n"));
goto exit;
}

p->isSource = headerIsSource(h);

Expand Down
37 changes: 37 additions & 0 deletions tests/rpmpython.at
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,43 @@ for e in ts:
[adding upgrade to transaction failed]
)

RPMPY_TEST([add bogus package to transaction 3],[

for tag in ["os", "arch", "name", "version", "release"]:
h = ts.hdrFromFdno('${RPMDATA}/RPMS/hello-1.0-1.ppc64.rpm')
del h[tag]
try:
ts.addInstall(h, 'foo', 'u')
except rpm.error as err:
myprint(err)
for e in ts:
myprint(e.NEVRA())
],
[adding upgrade to transaction failed
adding upgrade to transaction failed
adding upgrade to transaction failed
adding upgrade to transaction failed
adding upgrade to transaction failed
],
[])

RPMPY_TEST([add bogus package to transaction 4],[

h = ts.hdrFromFdno('${RPMDATA}/RPMS/hello-1.0-1.ppc64.rpm')
del h["name"]
h["name"] = "gpg-pubkey"
try:
ts.addInstall(h, 'foo', 'u')
except rpm.error as err:
myprint(err)
for e in ts:
myprint(e.NEVRA())
],
[adding upgrade to transaction failed
],
[error: public keys can not be installed as gpg-pubkey packages; use rpmkeys --import <keyfile> for that
])

RPMPY_TEST([transaction element userdata],[
mydata = { 'foo': 'bar', 'capstest': 'lock' }
ts.addInstall('${RPMDATA}/RPMS/foo-1.0-1.noarch.rpm', 'u')
Expand Down
10 changes: 10 additions & 0 deletions tests/rpmsigdig.at
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,16 @@ runroot rpmkeys --list
[0],
[],
[])

runroot rpmkeys --import /data/keys/rpm.org-rsa-2048-test.pub
RPMTEST_CHECK([
runroot rpm -e gpg-pubkey-771b18d3d7baa28734333c424344591e1964c5fc
runroot rpm -qa gpg-pubkey
],
[0],
[],
[warning: erasing gpg-pubkey packages is deprecated; use rpmkeys --delete 771b18d3d7baa28734333c424344591e1964c5fc
])
RPMTEST_CLEANUP

AT_SETUP([rpmkeys migrate from keyid to fingerprint (rpmdb)])
Expand Down
Loading