diff options
| author | Lennart Poettering <lennart@poettering.net> | 2015-03-02 20:24:11 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2015-03-02 20:24:11 +0100 |
| commit | 0acfdffe9417b4218e97b6d981c99a1a85e633c9 (patch) | |
| tree | 024659807a8cac649c08865dfb679a53481c8e35 | |
| parent | 7de304525deafe4eb86060321e39787138dbbadf (diff) | |
import: add support for gpg2 for verifying imported images
gpg2 insists on created a trust db even if we tun off all trust db
support. Hence create a temporary home where the trust db is placed, and
remove it after use.
| -rw-r--r-- | src/import/import-common.c | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/src/import/import-common.c b/src/import/import-common.c index 2acf380f99..f10a453eed 100644 --- a/src/import/import-common.c +++ b/src/import/import-common.c @@ -281,8 +281,9 @@ int import_verify( _cleanup_free_ char *fn = NULL; _cleanup_close_ int sig_file = -1; const char *p, *line; - char sig_file_path[] = "/tmp/sigXXXXXX"; + char sig_file_path[] = "/tmp/sigXXXXXX", gpg_home[] = "/tmp/gpghomeXXXXXX"; _cleanup_sigkill_wait_ pid_t pid = 0; + bool gpg_home_created = false; int r; assert(main_job); @@ -347,6 +348,13 @@ int import_verify( goto finish; } + if (!mkdtemp(gpg_home)) { + r = log_error_errno(errno, "Failed to create tempory home for gpg: %m"); + goto finish; + } + + gpg_home_created = true; + pid = fork(); if (pid < 0) return log_error_errno(errno, "Failed to fork off gpg: %m"); @@ -359,13 +367,14 @@ int import_verify( "--no-auto-check-trustdb", "--batch", "--trust-model=always", - NULL, /* keyring to use */ + NULL, /* --homedir= */ + NULL, /* --keyring= */ NULL, /* --verify */ NULL, /* signature file */ NULL, /* dash */ NULL /* trailing NULL */ }; - unsigned k = ELEMENTSOF(cmd) - 5; + unsigned k = ELEMENTSOF(cmd) - 6; int null_fd; /* Child */ @@ -398,6 +407,8 @@ int import_verify( if (null_fd != STDOUT_FILENO) null_fd = safe_close(null_fd); + cmd[k++] = strjoina("--homedir=", gpg_home); + /* We add the user keyring only to the command line * arguments, if it's around since gpg fails * otherwise. */ @@ -415,6 +426,7 @@ int import_verify( fd_cloexec(STDOUT_FILENO, false); fd_cloexec(STDERR_FILENO, false); + execvp("gpg2", (char * const *) cmd); execvp("gpg", (char * const *) cmd); log_error_errno(errno, "Failed to execute gpg: %m"); _exit(EXIT_FAILURE); @@ -446,6 +458,9 @@ finish: if (sig_file >= 0) unlink(sig_file_path); + if (gpg_home_created) + rm_rf_dangerous(gpg_home, false, true, false); + return r; } |