This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, core120 has been updated via 718119b897ed3a758745f0b59d078dded485a5e0 (commit) via 4d888e6854ebe9617cf305ab38ed33b9c23d8056 (commit) via e7cda9ac7f28fd9e12d2f2f6456d8c46b92887f7 (commit) via 0471d32b8525fe697cc4e6ffd143379bddbc6488 (commit) via 74e715a5a2767cedca7c6e1d9ba3570f3fa3dc1c (commit) via 397d3a8e153c38fc3262e463b5bb7ae6db66ec52 (commit) via 3e29608f826cb86244295697951ec0976345705e (commit) from 3e7dee59519133f9351a9800885853396d7d3b51 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 718119b897ed3a758745f0b59d078dded485a5e0 Merge: 3e7dee595 4d888e685 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Mon Apr 2 16:56:02 2018 +0200

Merge branch 'master' into core119

-----------------------------------------------------------------------

Summary of changes: config/rootfiles/common/curl | 3 +-- config/rootfiles/common/pakfire | 3 ++- config/rootfiles/core/120/filelists/files | 3 ++- config/rootfiles/core/120/update.sh | 2 +- lfs/curl | 2 -- src/initscripts/system/pakfire | 5 ++++- src/pakfire/lib/functions.pl | 28 +++++++++++++++++++++++- src/pakfire/pakfire-2007.key | 31 +++++++++++++++++++++++++++ src/pakfire/{pakfire.key => pakfire-2018.key} | 0 9 files changed, 68 insertions(+), 9 deletions(-) create mode 100644 src/pakfire/pakfire-2007.key rename src/pakfire/{pakfire.key => pakfire-2018.key} (100%)

Difference in files: diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl index b2be73384..aea07a6c7 100644 --- a/config/rootfiles/common/curl +++ b/config/rootfiles/common/curl @@ -11,9 +11,8 @@ usr/bin/curl #usr/include/curl/typecheck-gcc.h #usr/lib/libcurl.la #usr/lib/libcurl.so -usr/lib/libcurl.so.3 usr/lib/libcurl.so.4 -#usr/lib/libcurl.so.4.5.0 +usr/lib/libcurl.so.4.5.0 #usr/lib/pkgconfig/libcurl.pc #usr/share/aclocal/libcurl.m4 #usr/share/man/man1/curl-config.1 diff --git a/config/rootfiles/common/pakfire b/config/rootfiles/common/pakfire index 6cd531d15..0487c58f9 100644 --- a/config/rootfiles/common/pakfire +++ b/config/rootfiles/common/pakfire @@ -6,7 +6,8 @@ opt/pakfire/db/rootfiles #opt/pakfire/etc #opt/pakfire/pakfire.conf opt/pakfire/etc/pakfire.conf -opt/pakfire/pakfire.key +opt/pakfire/pakfire-2007.key +opt/pakfire/pakfire-2018.key #opt/pakfire/lib opt/pakfire/lib/functions.pl opt/pakfire/lib/functions.sh diff --git a/config/rootfiles/core/120/filelists/files b/config/rootfiles/core/120/filelists/files index 8648cfccb..c029cd430 100644 --- a/config/rootfiles/core/120/filelists/files +++ b/config/rootfiles/core/120/filelists/files @@ -8,7 +8,8 @@ etc/rc.d/init.d/unbound etc/rc.d/rcsysinit.d/S81pakfire opt/pakfire/lib/functions.pl opt/pakfire/pakfire -opt/pakfire/pakfire.key +opt/pakfire/pakfire-2007.key +opt/pakfire/pakfire-2018.key srv/web/ipfire/cgi-bin/ovpnmain.cgi srv/web/ipfire/cgi-bin/proxy.cgi srv/web/ipfire/cgi-bin/qos.cgi diff --git a/config/rootfiles/core/120/update.sh b/config/rootfiles/core/120/update.sh index 22d9d48d4..459262c86 100644 --- a/config/rootfiles/core/120/update.sh +++ b/config/rootfiles/core/120/update.sh @@ -75,7 +75,7 @@ fi sed -e "/UsePrivilegeSeparation/d" -i /etc/ssh/sshd_config

# Import new Pakfire key -gpg --import /opt/pakfire/pakfire.key +/etc/init.d/pakfire start

# This update needs a reboot... touch /var/run/need_reboot diff --git a/lfs/curl b/lfs/curl index ebb093f56..5a6fdc664 100644 --- a/lfs/curl +++ b/lfs/curl @@ -78,7 +78,5 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --with-ca-bundle=/etc/ssl/certs/ca-bundle.crt cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install - # Create symlink to new curl lib for old binaries - ln -sf libcurl.so.4 /usr/lib/libcurl.so.3 @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/initscripts/system/pakfire b/src/initscripts/system/pakfire index 1238833d5..43befc796 100644 --- a/src/initscripts/system/pakfire +++ b/src/initscripts/system/pakfire @@ -12,8 +12,11 @@ case "${1}" in start) boot_mesg "Setting up Pakfire Package Manager..." - gpg --import /opt/pakfire/pakfire.key &>/dev/null + gpg --import /opt/pakfire/pakfire-2018.key &>/dev/null evaluate_retval + + # Try to import the old key, too + gpg --import /opt/pakfire/pakfire-2007.key &>/dev/null ;;

*) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index 78761aef6..dd4007a44 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -35,6 +35,13 @@ use Switch;

package Pakfire;

+my @VALID_KEY_FINGERPRINTS = ( + # 2018 + "3ECA8AA4478208B924BB96206FEF7A8ED713594B", + # 2007 + "179740DC4D8C47DC63C099C74BDE364C64D96617", +); + # A small color-hash :D my %color; $color{'normal'} = "\033[0m"; @@ -215,7 +222,7 @@ sub fetchfile { print FILE $final_data; close(FILE); logger("DOWNLOAD INFO: File received. Start checking signature..."); - if (system("gpg --verify "$Conf::tmpdir/$bfile" &>/dev/null") eq 0) { + if (&valid_signature("$Conf::tmpdir/$bfile")) { logger("DOWNLOAD INFO: Signature of $bfile is fine."); move("$Conf::tmpdir/$bfile","$Conf::cachedir/$bfile"); } else { @@ -288,6 +295,25 @@ sub getcoredb { } }

+sub valid_signature($) { + my $filename = shift; + + open(my $cmd, "gpg --verify --status-fd 1 "$filename" 2>/dev/null |"); + while (<$cmd>) { + # Process valid signature lines + if (/VALIDSIG ([A-Z0-9]+)/) { + # Check if we know the key + foreach my $key (@VALID_KEY_FINGERPRINTS) { + # Signature is valid + return 1 if ($key eq $1); + } + } + } + close($cmd); + + # Signature is invalid + return 0; +}

sub selectmirror { ### Check if there is a current server list and read it. diff --git a/src/pakfire/pakfire-2007.key b/src/pakfire/pakfire-2007.key new file mode 100644 index 000000000..ced120ad8 --- /dev/null +++ b/src/pakfire/pakfire-2007.key @@ -0,0 +1,31 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGiBEYssZ8RBACcbHcYW+gPbjPFxv4ImlK1FgXV3s65Nnu7V9kghB7AZXterMVM +rZ87sNEw6J3JT32k0e9iBukA1QrshPg3c/mL+2/lMvvxsUW19rj/8ZBCCnP1Svgq +9q0OSJfadbm9b6Ndj06D/3EM+VpY5aI7XgNenh7ZcDbY9m8YDPdu0OF9uwCgltJS ++Pzjr16bJ/VnI549LfIG2KkEAJZWQmLQSXbl4VVEOSyaaJN8ugGBnZtnaL6IBE9K +0FHoZU3GaEOP6L3IUHUzyWsrpC/G44hGPC3xIbr5VG3sJ6hUc3J2rjx1clFdyN6A +bte9EWk1HkRFdaMfDn86vhIjn7znHU4cbvQLIpgB12+y2P/ydqLwyuyf6rV1JEWk +pSXpA/91LnlvICvqompSmrpLKpb+DSe59tr/r5GI36VNnqWt32InmF0N2ceLwG1F +K62M4Tf5/OZOg5m3uoTTHWf355+7NJjyPzT+DYbsuK56TNd/cFPeVdisdteeuINj +3DIC/8H9Y7mvYMAoSNtdA74JrdzGiqH2zSTB/oa/nwDXFekrq7Q2TWljaGFlbCBU +cmVtZXIgKFBha2ZpcmUgU2lnbmluZyBLZXkpIDxwYWtzQGlwZmlyZS5vcmc+iFoE +ExECABoFAkYssZ8CGwMCCwIDFQIDAxYCAQIeAQIXgAAKCRBL3jZMZNlmF0pBAJ95 +S5xzasjMQLpvOWA9E4JG3YJasQCfbNpdZXbZHr7Io7hLR9iJ+OhybfuIawQQEQIA +KwUCRi3ByAWDAeKFAB4aaHR0cDovL3d3dy5jYWNlcnQub3JnL2Nwcy5waHAACgkQ +0rsNAWXQ/VjJhQCfUQh+9wPAlyQVb9gYZ5zgHfqDY1MAn2T/VXH2+acwC4O3oV1W +Ni36NNRpuQINBEYsuJoQCAC6wq4ZMtWRGF/GeTd9l7boo40ulBth8Wr+IBK38XYv +5s+WLiTuuTCM8Thq4eY3MOfO+VXhjQen1S2e8WiZq+c55pDDAKXvBFmVNKcgkK7C +1AW85kY86aspoAK3/vi2pghlXAysTKSoW+WfoCbASDheEJopOkIMehdroraI2zTM +y8AEk+TnbRPzoFNBEYwr3J1GlkegtU3mIPpALDfpL4+HoCgS+7SfAvIlG//C+4W/ +oI/VOYHDdM5zR1av/pVZGpUK4Ao/JBxXMaqsbiP43KytbNuMRsZ+sFDs/ZtmHf1z +6AQ8mnxU0klT4ppU8Nl3hSVcvRacm6wBTvvGEqjkApkPAAMFCACKWJVpzcVAdOMP +aB08qJ+GPSSgxspaSoFPjVN307Pr1Di/ZriC/UVNrq/eUHEIvC1zIx+t3O109qVH +RMWbfCj+4/OBHJ4Ik3Nc5/8v6zaGwixJrkjohF8QLwodqazrjc+W3VsQ5jwfPpLe +DFpd3xHhj5zhXQKN0tCCk435Q/58aMQCK75St3/ymP6NGaE2s7dsXU/BwndgfxJu +Yz8LEK6phJ2t0jBiJJgcjWkoBkq8MhI6wKW6uDU4B/KKGHHLuZHg1ZKum8ASMcti +S980DlSJyfLJnUIio5F/u/csug8bHKq5pA1x+wmsUBhuH66aosNJuz35Bl4nW365 +PoahYtQBiEkEGBECAAkFAkYsuJsCGwwACgkQS942TGTZZheq7ACfTrW5OaZOhrwt +Jr+xgdjSFRrT14cAnjkEj51RQsP7LS5UTm+yce2olHDp +=hYb3 +-----END PGP PUBLIC KEY BLOCK----- diff --git a/src/pakfire/pakfire.key b/src/pakfire/pakfire-2018.key similarity index 100% rename from src/pakfire/pakfire.key rename to src/pakfire/pakfire-2018.key

hooks/post-receive -- IPFire 2.x development tree