diff options
| -rw-r--r-- | db-functions | 15 | ||||
| -rwxr-xr-x | db-update | 3 | ||||
| -rw-r--r-- | test/lib/common.inc | 29 | ||||
| -rwxr-xr-x | test/test.d/signed-packages.sh | 20 |
4 files changed, 62 insertions, 5 deletions
diff --git a/db-functions b/db-functions index a3e2168..7c4a7fe 100644 --- a/db-functions +++ b/db-functions @@ -466,6 +466,21 @@ check_repo_permission() { return 0 } +check_pkgsig() { + local signature=$1 + local ret=1 + local fd="$(mktemp --tmpdir="${WORKDIR}")" + + exec 4>"${fd}" + gpg --homedir /etc/pacman.d/gnupg/ --status-fd 4 --verify "${signature}" >/dev/null 2>&1 + exec 4>&- + if grep -q TRUST_FULLY "${fd}"; then + ret=0 + fi + + return $ret +} + set_repo_permission() { local repo=$1 local arch=$2 @@ -35,6 +35,9 @@ for repo in ${repos[@]}; do if ! check_pkgfile "${pkg}"; then die "Package ${repo}/$(basename ${pkg}) is not consistent with its meta data" fi + if ${REQUIRE_SIGNATURE} && ! check_pkgsig "${pkg}.sig"; then + die "Package ${repo}/$(basename ${pkg}) does not have a valid signature" + fi if ! check_pkgsvn "${pkg}" "${repo}"; then die "Package ${repo}/$(basename ${pkg}) is not consistent with svn repository" fi diff --git a/test/lib/common.inc b/test/lib/common.inc index a2dee10..e0e7048 100644 --- a/test/lib/common.inc +++ b/test/lib/common.inc @@ -3,6 +3,21 @@ set -E . "$(dirname ${BASH_SOURCE[0]})/../../config" . "$(dirname ${BASH_SOURCE[0]})/../../db-functions" +signpkg() { + if [[ -r '/etc/makepkg.conf' ]]; then + source '/etc/makepkg.conf' + else + die '/etc/makepkg.conf not found!' + fi + if [[ -r ~/.makepkg.conf ]]; then + . ~/.makepkg.conf + fi + if [[ -n $GPGKEY ]]; then + SIGNWITHKEY="-u ${GPGKEY}" + fi + gpg --detach-sign --use-agent ${SIGNWITHKEY} ${@} || die +} + oneTimeSetUp() { local p local d @@ -110,18 +125,24 @@ releasePackage() { local repo=$1 local pkgbase=$2 local arch=$3 + local a + local p + local pkgver + local pkgname pushd "${TMP}/svn-packages-copy"/${pkgbase}/trunk/ >/dev/null archrelease ${repo}-${arch} >/dev/null 2&>1 pkgver=$(. PKGBUILD; echo $(get_full_version ${epoch:-0} ${pkgver} ${pkgrel})) + pkgname=($(. PKGBUILD; echo ${pkgname[@]})) popd >/dev/null cp "${pkgdir}/${pkgbase}"/*-${pkgver}-${arch}${PKGEXT} "${STAGING}"/${repo}/ if ${REQUIRE_SIGNATURE}; then - # TODO: really sign the packages with a valid key - find "${STAGING}"/${repo}/ -type f \ - -name "*-${pkgver}-${arch}${PKGEXT}" \ - -exec touch {}.sig \; + for a in ${arch[@]}; do + for p in ${pkgname[@]}; do + signpkg "${STAGING}"/${repo}/${p}-${pkgver}-${a}${PKGEXT} + done + done fi } diff --git a/test/test.d/signed-packages.sh b/test/test.d/signed-packages.sh index 5d6f4ff..20ad844 100755 --- a/test/test.d/signed-packages.sh +++ b/test/test.d/signed-packages.sh @@ -5,9 +5,27 @@ curdir=$(readlink -e $(dirname $0)) testAddUnsignedPackage() { releasePackage extra 'pkg-simple-a' 'i686' - # remove any signature rm "${STAGING}"/extra/*.sig ../db-update >/dev/null 2>&1 && fail "db-update should fail when a signature is missing!" } +testAddInvalidSignedPackage() { + local p + releasePackage extra 'pkg-simple-a' 'i686' + for p in "${STAGING}"/extra/*${PKGEXT}; do + unxz $p + xz -0 ${p%%.xz} + done + ../db-update >/dev/null 2>&1 && fail "db-update should fail when a signature is invalid!" +} + +testAddBrokenSignature() { + local s + releasePackage extra 'pkg-simple-a' 'i686' + for s in "${STAGING}"/extra/*.sig; do + echo 0 > $s + done + ../db-update >/dev/null 2>&1 && fail "db-update should fail when a signature is broken!" +} + . "${curdir}/../lib/shunit2" |