From: git@ipfire.org
To: ipfire-scm@lists.ipfire.org
Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 4d888e6854ebe9617cf305ab38ed33b9c23d8056
Date: Mon, 02 Apr 2018 15:54:56 +0100 [thread overview]
Message-ID: <20180402145457.45ABA1081DF2@git01.ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 10072 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, master has been updated
via 4d888e6854ebe9617cf305ab38ed33b9c23d8056 (commit)
via e7cda9ac7f28fd9e12d2f2f6456d8c46b92887f7 (commit)
via 0471d32b8525fe697cc4e6ffd143379bddbc6488 (commit)
via 74e715a5a2767cedca7c6e1d9ba3570f3fa3dc1c (commit)
via 397d3a8e153c38fc3262e463b5bb7ae6db66ec52 (commit)
via 3e29608f826cb86244295697951ec0976345705e (commit)
from 36600cef36577ca36d4349bc7658a68234311ea2 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 4d888e6854ebe9617cf305ab38ed33b9c23d8056
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:50:09 2018 +0100
curl: Drop old compatibility symlink
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit e7cda9ac7f28fd9e12d2f2f6456d8c46b92887f7
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:48:50 2018 +0100
curl: Rootfile update
Main library was missing
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 0471d32b8525fe697cc4e6ffd143379bddbc6488
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:46:31 2018 +0100
core120: Import new pakfire keys
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 74e715a5a2767cedca7c6e1d9ba3570f3fa3dc1c
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:07:56 2018 +0100
pakfire: Import old key, too
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 397d3a8e153c38fc3262e463b5bb7ae6db66ec52
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:06:02 2018 +0100
pakfire: Rename new key to pakfire-2018.key
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
commit 3e29608f826cb86244295697951ec0976345705e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date: Mon Apr 2 15:45:48 2018 +0100
pakfire: Validate signatures when multiple are available
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/curl | 3 +--
config/rootfiles/common/pakfire | 3 ++-
config/rootfiles/core/120/filelists/files | 3 ++-
config/rootfiles/core/120/update.sh | 2 +-
lfs/curl | 2 --
src/initscripts/system/pakfire | 5 ++++-
src/pakfire/lib/functions.pl | 28 +++++++++++++++++++++++-
src/pakfire/pakfire-2007.key | 31 +++++++++++++++++++++++++++
src/pakfire/{pakfire.key => pakfire-2018.key} | 0
9 files changed, 68 insertions(+), 9 deletions(-)
create mode 100644 src/pakfire/pakfire-2007.key
rename src/pakfire/{pakfire.key => pakfire-2018.key} (100%)
Difference in files:
diff --git a/config/rootfiles/common/curl b/config/rootfiles/common/curl
index b2be73384..aea07a6c7 100644
--- a/config/rootfiles/common/curl
+++ b/config/rootfiles/common/curl
@@ -11,9 +11,8 @@ usr/bin/curl
#usr/include/curl/typecheck-gcc.h
#usr/lib/libcurl.la
#usr/lib/libcurl.so
-usr/lib/libcurl.so.3
usr/lib/libcurl.so.4
-#usr/lib/libcurl.so.4.5.0
+usr/lib/libcurl.so.4.5.0
#usr/lib/pkgconfig/libcurl.pc
#usr/share/aclocal/libcurl.m4
#usr/share/man/man1/curl-config.1
diff --git a/config/rootfiles/common/pakfire b/config/rootfiles/common/pakfire
index 6cd531d15..0487c58f9 100644
--- a/config/rootfiles/common/pakfire
+++ b/config/rootfiles/common/pakfire
@@ -6,7 +6,8 @@ opt/pakfire/db/rootfiles
#opt/pakfire/etc
#opt/pakfire/pakfire.conf
opt/pakfire/etc/pakfire.conf
-opt/pakfire/pakfire.key
+opt/pakfire/pakfire-2007.key
+opt/pakfire/pakfire-2018.key
#opt/pakfire/lib
opt/pakfire/lib/functions.pl
opt/pakfire/lib/functions.sh
diff --git a/config/rootfiles/core/120/filelists/files b/config/rootfiles/core/120/filelists/files
index 88f7d047f..d98e3a918 100644
--- a/config/rootfiles/core/120/filelists/files
+++ b/config/rootfiles/core/120/filelists/files
@@ -7,7 +7,8 @@ etc/rc.d/init.d/pakfire
etc/rc.d/init.d/unbound
etc/rc.d/rcsysinit.d/S81pakfire
opt/pakfire/lib/functions.pl
-opt/pakfire/pakfire.key
+opt/pakfire/pakfire-2007.key
+opt/pakfire/pakfire-2018.key
srv/web/ipfire/cgi-bin/ovpnmain.cgi
srv/web/ipfire/cgi-bin/proxy.cgi
srv/web/ipfire/cgi-bin/qos.cgi
diff --git a/config/rootfiles/core/120/update.sh b/config/rootfiles/core/120/update.sh
index 22d9d48d4..459262c86 100644
--- a/config/rootfiles/core/120/update.sh
+++ b/config/rootfiles/core/120/update.sh
@@ -75,7 +75,7 @@ fi
sed -e "/UsePrivilegeSeparation/d" -i /etc/ssh/sshd_config
# Import new Pakfire key
-gpg --import /opt/pakfire/pakfire.key
+/etc/init.d/pakfire start
# This update needs a reboot...
touch /var/run/need_reboot
diff --git a/lfs/curl b/lfs/curl
index ebb093f56..5a6fdc664 100644
--- a/lfs/curl
+++ b/lfs/curl
@@ -78,7 +78,5 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
--with-ca-bundle=/etc/ssl/certs/ca-bundle.crt
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
- # Create symlink to new curl lib for old binaries
- ln -sf libcurl.so.4 /usr/lib/libcurl.so.3
@rm -rf $(DIR_APP)
@$(POSTBUILD)
diff --git a/src/initscripts/system/pakfire b/src/initscripts/system/pakfire
index 1238833d5..43befc796 100644
--- a/src/initscripts/system/pakfire
+++ b/src/initscripts/system/pakfire
@@ -12,8 +12,11 @@
case "${1}" in
start)
boot_mesg "Setting up Pakfire Package Manager..."
- gpg --import /opt/pakfire/pakfire.key &>/dev/null
+ gpg --import /opt/pakfire/pakfire-2018.key &>/dev/null
evaluate_retval
+
+ # Try to import the old key, too
+ gpg --import /opt/pakfire/pakfire-2007.key &>/dev/null
;;
*)
diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl
index 78761aef6..dd4007a44 100644
--- a/src/pakfire/lib/functions.pl
+++ b/src/pakfire/lib/functions.pl
@@ -35,6 +35,13 @@ use Switch;
package Pakfire;
+my @VALID_KEY_FINGERPRINTS = (
+ # 2018
+ "3ECA8AA4478208B924BB96206FEF7A8ED713594B",
+ # 2007
+ "179740DC4D8C47DC63C099C74BDE364C64D96617",
+);
+
# A small color-hash :D
my %color;
$color{'normal'} = "\033[0m";
@@ -215,7 +222,7 @@ sub fetchfile {
print FILE $final_data;
close(FILE);
logger("DOWNLOAD INFO: File received. Start checking signature...");
- if (system("gpg --verify \"$Conf::tmpdir/$bfile\" &>/dev/null") eq 0) {
+ if (&valid_signature("$Conf::tmpdir/$bfile")) {
logger("DOWNLOAD INFO: Signature of $bfile is fine.");
move("$Conf::tmpdir/$bfile","$Conf::cachedir/$bfile");
} else {
@@ -288,6 +295,25 @@ sub getcoredb {
}
}
+sub valid_signature($) {
+ my $filename = shift;
+
+ open(my $cmd, "gpg --verify --status-fd 1 \"$filename\" 2>/dev/null |");
+ while (<$cmd>) {
+ # Process valid signature lines
+ if (/VALIDSIG ([A-Z0-9]+)/) {
+ # Check if we know the key
+ foreach my $key (@VALID_KEY_FINGERPRINTS) {
+ # Signature is valid
+ return 1 if ($key eq $1);
+ }
+ }
+ }
+ close($cmd);
+
+ # Signature is invalid
+ return 0;
+}
sub selectmirror {
### Check if there is a current server list and read it.
diff --git a/src/pakfire/pakfire-2007.key b/src/pakfire/pakfire-2007.key
new file mode 100644
index 000000000..ced120ad8
--- /dev/null
+++ b/src/pakfire/pakfire-2007.key
@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGiBEYssZ8RBACcbHcYW+gPbjPFxv4ImlK1FgXV3s65Nnu7V9kghB7AZXterMVM
+rZ87sNEw6J3JT32k0e9iBukA1QrshPg3c/mL+2/lMvvxsUW19rj/8ZBCCnP1Svgq
+9q0OSJfadbm9b6Ndj06D/3EM+VpY5aI7XgNenh7ZcDbY9m8YDPdu0OF9uwCgltJS
++Pzjr16bJ/VnI549LfIG2KkEAJZWQmLQSXbl4VVEOSyaaJN8ugGBnZtnaL6IBE9K
+0FHoZU3GaEOP6L3IUHUzyWsrpC/G44hGPC3xIbr5VG3sJ6hUc3J2rjx1clFdyN6A
+bte9EWk1HkRFdaMfDn86vhIjn7znHU4cbvQLIpgB12+y2P/ydqLwyuyf6rV1JEWk
+pSXpA/91LnlvICvqompSmrpLKpb+DSe59tr/r5GI36VNnqWt32InmF0N2ceLwG1F
+K62M4Tf5/OZOg5m3uoTTHWf355+7NJjyPzT+DYbsuK56TNd/cFPeVdisdteeuINj
+3DIC/8H9Y7mvYMAoSNtdA74JrdzGiqH2zSTB/oa/nwDXFekrq7Q2TWljaGFlbCBU
+cmVtZXIgKFBha2ZpcmUgU2lnbmluZyBLZXkpIDxwYWtzQGlwZmlyZS5vcmc+iFoE
+ExECABoFAkYssZ8CGwMCCwIDFQIDAxYCAQIeAQIXgAAKCRBL3jZMZNlmF0pBAJ95
+S5xzasjMQLpvOWA9E4JG3YJasQCfbNpdZXbZHr7Io7hLR9iJ+OhybfuIawQQEQIA
+KwUCRi3ByAWDAeKFAB4aaHR0cDovL3d3dy5jYWNlcnQub3JnL2Nwcy5waHAACgkQ
+0rsNAWXQ/VjJhQCfUQh+9wPAlyQVb9gYZ5zgHfqDY1MAn2T/VXH2+acwC4O3oV1W
+Ni36NNRpuQINBEYsuJoQCAC6wq4ZMtWRGF/GeTd9l7boo40ulBth8Wr+IBK38XYv
+5s+WLiTuuTCM8Thq4eY3MOfO+VXhjQen1S2e8WiZq+c55pDDAKXvBFmVNKcgkK7C
+1AW85kY86aspoAK3/vi2pghlXAysTKSoW+WfoCbASDheEJopOkIMehdroraI2zTM
+y8AEk+TnbRPzoFNBEYwr3J1GlkegtU3mIPpALDfpL4+HoCgS+7SfAvIlG//C+4W/
+oI/VOYHDdM5zR1av/pVZGpUK4Ao/JBxXMaqsbiP43KytbNuMRsZ+sFDs/ZtmHf1z
+6AQ8mnxU0klT4ppU8Nl3hSVcvRacm6wBTvvGEqjkApkPAAMFCACKWJVpzcVAdOMP
+aB08qJ+GPSSgxspaSoFPjVN307Pr1Di/ZriC/UVNrq/eUHEIvC1zIx+t3O109qVH
+RMWbfCj+4/OBHJ4Ik3Nc5/8v6zaGwixJrkjohF8QLwodqazrjc+W3VsQ5jwfPpLe
+DFpd3xHhj5zhXQKN0tCCk435Q/58aMQCK75St3/ymP6NGaE2s7dsXU/BwndgfxJu
+Yz8LEK6phJ2t0jBiJJgcjWkoBkq8MhI6wKW6uDU4B/KKGHHLuZHg1ZKum8ASMcti
+S980DlSJyfLJnUIio5F/u/csug8bHKq5pA1x+wmsUBhuH66aosNJuz35Bl4nW365
+PoahYtQBiEkEGBECAAkFAkYsuJsCGwwACgkQS942TGTZZheq7ACfTrW5OaZOhrwt
+Jr+xgdjSFRrT14cAnjkEj51RQsP7LS5UTm+yce2olHDp
+=hYb3
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/src/pakfire/pakfire.key b/src/pakfire/pakfire-2018.key
similarity index 100%
rename from src/pakfire/pakfire.key
rename to src/pakfire/pakfire-2018.key
hooks/post-receive
--
IPFire 2.x development tree
reply other threads:[~2018-04-02 14:54 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180402145457.45ABA1081DF2@git01.ipfire.org \
--to=git@ipfire.org \
--cc=ipfire-scm@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox