Bug 2009927 - Add support for rpmsign in the gpg2 signer #1187
+363
−54
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,6 +19,7 @@ RUN apt-get update && \ | |
| libncurses5 \ | ||
| devscripts \ | ||
| apksigner \ | ||
| rpm \ | ||
| gcc \ | ||
| g++ \ | ||
| libc6-dev \ | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,6 +31,9 @@ const ( | |
| // ModeDebsign represents a signer that signs files with debsign | ||
| ModeDebsign = "debsign" | ||
|
|
||
| // ModeRPMSign represents a signer that signs RPM files with rpmsign | ||
| ModeRPMSign = "rpmsign" | ||
|
|
||
| keyRingFilename = "autograph_gpg2_keyring.gpg" | ||
| gpgConfFilename = "gpg.conf" | ||
|
|
||
|
|
@@ -101,11 +104,12 @@ func New(conf signer.Configuration, tmpDirPrefix string) (s *GPG2Signer, err err | |
|
|
||
| switch conf.Mode { | ||
| case ModeDebsign: | ||
| case ModeRPMSign: | ||
| case ModeGPG2: | ||
| case "": // default to signing in gpg2 mode to preserve backwards compat with old config files | ||
| conf.Mode = ModeGPG2 | ||
| default: | ||
| return nil, fmt.Errorf("gpg2: unknown signer mode %q, must be 'gpg2', 'debsign', or 'rpmsign'", conf.Mode) | ||
| } | ||
| s.Mode = conf.Mode | ||
|
|
||
|
|
@@ -136,9 +140,9 @@ func New(conf signer.Configuration, tmpDirPrefix string) (s *GPG2Signer, err err | |
| return nil, fmt.Errorf("gpg2: error creating keyring: %w", err) | ||
| } | ||
|
|
||
| // debsign and rpmsign invoke GPG for signing. We configure GPG | ||
| // via gpg.conf in $GNUPGHOME since we can't pass args directly to either tool. | ||
| if s.Mode == ModeDebsign || s.Mode == ModeRPMSign { | ||
| // write gpg.conf after importing keys, so gpg doesn't try to read stdin for key imports | ||
| if err = writeGPGConf(s.tmpDir); err != nil { | ||
| return nil, fmt.Errorf("error writing gpg conf: %w", err) | ||
|
|
@@ -371,11 +375,12 @@ func (s *GPG2Signer) GetDefaultOptions() interface{} { | |
| return Options{} | ||
| } | ||
|
|
||
| // SignFiles uses debsign or rpmsign to sign multiple named files. | ||
| // In debsign mode: signs *.buildinfo, *.dsc, or *.changes files (clearsign) | ||
| // In rpmsign mode: signs *.rpm files (embedded signature) | ||
| func (s *GPG2Signer) SignFiles(inputs []signer.NamedUnsignedFile, options interface{}) (signedFiles []signer.NamedSignedFile, err error) { | ||
| if s.Mode != ModeDebsign && s.Mode != ModeRPMSign { | ||
| err = fmt.Errorf("gpg2: can only sign multiple files in %s or %s mode", ModeDebsign, ModeRPMSign) | ||
| return | ||
| } | ||
|
|
||
|
|
@@ -384,7 +389,7 @@ func (s *GPG2Signer) SignFiles(inputs []signer.NamedUnsignedFile, options interf | |
| // of this directory. | ||
| inputsTmpDir, err := os.MkdirTemp(s.tmpDir, "sign_files") | ||
| if err != nil { | ||
| err = fmt.Errorf("gpg2: error creating tempdir for %s signing: %w", s.Mode, err) | ||
| return | ||
| } | ||
| defer func() { | ||
|
|
@@ -397,13 +402,20 @@ func (s *GPG2Signer) SignFiles(inputs []signer.NamedUnsignedFile, options interf | |
| var inputFilePaths []string | ||
| for i, input := range inputs { | ||
| ext := filepath.Ext(input.Name) | ||
| switch s.Mode { | ||
| case ModeDebsign: | ||
| if !(ext == ".buildinfo" || ext == ".dsc" || ext == ".changes") { | ||
| return nil, fmt.Errorf("gpg2: cannot sign file %d. File missing extension .buildinfo, .dsc, or .changes", i) | ||
| } | ||
| case ModeRPMSign: | ||
| if ext != ".rpm" { | ||
| return nil, fmt.Errorf("gpg2: cannot sign file %d. File missing extension .rpm", i) | ||
| } | ||
| } | ||
| inputFilePath := filepath.Join(inputsTmpDir, input.Name) | ||
| err := os.WriteFile(inputFilePath, input.Bytes, 0644) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("gpg2: failed to write tempfile %d for %s to sign: %w", i, s.Mode, err) | ||
| } | ||
| inputFilePaths = append(inputFilePaths, inputFilePath) | ||
| } | ||
|
|
@@ -412,50 +424,83 @@ func (s *GPG2Signer) SignFiles(inputs []signer.NamedUnsignedFile, options interf | |
| serializeSigning.Lock() | ||
| defer serializeSigning.Unlock() | ||
|
|
||
| var cmd *exec.Cmd | ||
| var passphraseRepeat int | ||
|
|
||
| switch s.Mode { | ||
| case ModeDebsign: | ||
| args := append([]string{ | ||
| // "Do not read any configuration files. This can only be used as the first option given on the command-line." | ||
| "--no-conf", | ||
| // "Specify the key ID to be used for signing; overrides any -m and -e options." | ||
| // debsign prefers the pub key fingerprint: https://github.com/Debian/devscripts/blob/16f9a6d24f4bd564c315f81b89e08c3b4fb76f13/scripts/debsign.sh#L389 | ||
| "-k", s.KeyID, | ||
| // "Recreate signature" | ||
| "--re-sign", | ||
| }, inputFilePaths...) | ||
| cmd = exec.Command("debsign", args...) | ||
| // debsign can call gpg multiple times per file | ||
| passphraseRepeat = len(inputFilePaths) * 4 | ||
|
Comment on lines
+442
to
+443
Contributor
There was a problem hiding this comment. Can you elaborate more on why we are multiplying by 4 here?
Author
There was a problem hiding this comment.
|
||
| case ModeRPMSign: | ||
| // We pass passphrase-fd 3 via _gpg_sign_cmd_extra_args to override | ||
| // passphrase-fd 0 from gpg.conf. This is because rpmsign uses stdin | ||
| // to pipe header data to GPG for signing but not the passphrase. Having | ||
| // passphrase-fd 0 in gpg.conf causes GPG to consume header data as passphrase, | ||
| // corrupting the data getting signed since the start will be omitted. | ||
| // We set up fd 3 ourselves via cmd.ExtraFiles and pass the passphrase through that. | ||
| // See https://github.com/rpm-software-management/rpm/blob/4623d4601ee83b5e0ecd16dd3f54d2182b519b30/sign/rpmgensig.c#L254 | ||
| args := append([]string{ | ||
| "--addsign", | ||
| "--key-id", s.KeyID, | ||
| "--define", "__gpg /usr/bin/gpg", | ||
| "--define", "_gpg_sign_cmd_extra_args --passphrase-fd 3", | ||
| }, inputFilePaths...) | ||
|
Comment on lines
+452
to
+457
Contributor
There was a problem hiding this comment. @Eijebong, @alexcottner and I checked the documentation and do not see what There was a problem hiding this comment.
|
||
| cmd = exec.Command("rpmsign", args...) | ||
| // rpmsign calls gpg once per file | ||
| passphraseRepeat = len(inputFilePaths) | ||
| } | ||
|
|
||
| cmd.Env = append(os.Environ(), | ||
| fmt.Sprintf("GNUPGHOME=%s", s.tmpDir), | ||
| ) | ||
|
|
||
| passphraseReader, passphraseWriter, err := os.Pipe() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("gpg2: failed to create %s passphrase pipe: %w", s.Mode, err) | ||
| } | ||
| defer passphraseReader.Close() | ||
|
|
||
| // Write passphrase to pipe (multiple times, once per signing operation) | ||
| passphrases := strings.Repeat(fmt.Sprintf("%s\n", s.passphrase), passphraseRepeat) | ||
| if _, err = io.WriteString(passphraseWriter, passphrases); err != nil { | ||
| passphraseWriter.Close() | ||
| return nil, fmt.Errorf("gpg2: failed to write %s passphrase to pipe: %w", s.Mode, err) | ||
| } | ||
| passphraseWriter.Close() | ||
|
|
||
| // For rpmsign, pass passphrase via fd 3, for debsign via fd 0 (stdin) | ||
| if s.Mode == ModeRPMSign { | ||
| cmd.ExtraFiles = []*os.File{passphraseReader} | ||
| } else { | ||
| cmd.Stdin = passphraseReader | ||
| } | ||
|
|
||
| out, err := cmd.CombinedOutput() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("gpg2: failed to %s inputs: %w\n%s", s.Mode, err, out) | ||
| } | ||
|
|
||
| // read the signed tempfiles | ||
| for i, inputFilePath := range inputFilePaths { | ||
| signedFileBytes, err := os.ReadFile(inputFilePath) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("gpg2: failed to read %d %q signed by %s: %w", i, inputFilePath, s.Mode, err) | ||
| } | ||
| signedFiles = append(signedFiles, signer.NamedSignedFile{ | ||
| Name: inputs[i].Name, | ||
| Bytes: signedFileBytes, | ||
| }) | ||
| } | ||
| log.Debugf("%s output:\n%s\n", s.Mode, string(out)) | ||
| return signedFiles, nil | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Validated that this is the correct key-pair by running:
and checked that the output from the private key above matches the public key below.