2 * \file lib/signature.c
7 #include "rpmio_internal.h"
9 #include <rpmmacro.h> /* XXX for rpmGetPath() */
11 #include "misc.h" /* XXX for dosetenv() and makeTempFile() */
13 #include "signature.h"
16 /*@access Header@*/ /* XXX compared with NULL */
17 /*@access FD_t@*/ /* XXX compared with NULL */
19 int rpmLookupSignatureType(int action)
21 static int disabled = 0;
25 case RPMLOOKUPSIG_DISABLE:
28 case RPMLOOKUPSIG_ENABLE:
31 case RPMLOOKUPSIG_QUERY:
34 { const char *name = rpmExpand("%{_signature}", NULL);
35 if (!(name && *name != '%'))
37 else if (!xstrcasecmp(name, "none"))
39 else if (!xstrcasecmp(name, "pgp"))
41 else if (!xstrcasecmp(name, "pgp5")) /* XXX legacy */
43 else if (!xstrcasecmp(name, "gpg"))
46 rc = -1; /* Invalid %_signature spec in macro file */
53 /* rpmDetectPGPVersion() returns the absolute path to the "pgp" */
54 /* executable of the requested version, or NULL when none found. */
56 const char * rpmDetectPGPVersion(pgpVersion * pgpVer)
58 /* Actually this should support having more then one pgp version. */
59 /* At the moment only one version is possible since we only */
60 /* have one %_pgpbin and one %_pgp_path. */
62 static pgpVersion saved_pgp_version = PGP_UNKNOWN;
63 const char *pgpbin = rpmGetPath("%{_pgpbin}", NULL);
65 if (saved_pgp_version == PGP_UNKNOWN) {
69 if (!(pgpbin && pgpbin[0] != '%')) {
70 pgpbin = _free(pgpbin);
71 saved_pgp_version = -1;
74 pgpvbin = (char *)alloca(strlen(pgpbin) + sizeof("v"));
75 (void)stpcpy(stpcpy(pgpvbin, pgpbin), "v");
77 if (stat(pgpvbin, &st) == 0)
78 saved_pgp_version = PGP_5;
79 else if (stat(pgpbin, &st) == 0)
80 saved_pgp_version = PGP_2;
82 saved_pgp_version = PGP_NOTDETECTED;
86 *pgpVer = saved_pgp_version;
92 * @todo rpmio: use fdSize rather than fstat(2) to get file size.
93 * @param fd package file handle
94 * @param siglen signature header size
95 * @param pad signature padding
96 * @param datalen length of header+payload
97 * @return rpmRC return code
99 static inline rpmRC checkSize(FD_t fd, int siglen, int pad, int datalen)
100 /*@globals fileSystem @*/
101 /*@modifies fileSystem @*/
106 if (fstat(Fileno(fd), &st))
109 if (!S_ISREG(st.st_mode)) {
110 rpmMessage(RPMMESS_DEBUG,
111 _("file is not regular -- skipping size check\n"));
116 rc = (((sizeof(struct rpmlead) + siglen + pad + datalen) - st.st_size)
117 ? RPMRC_BADSIZE : RPMRC_OK);
119 rpmMessage((rc == RPMRC_OK ? RPMMESS_DEBUG : RPMMESS_WARNING),
120 _("Expected size: %12d = lead(%d)+sigs(%d)+pad(%d)+data(%d)\n"),
121 (int)sizeof(struct rpmlead)+siglen+pad+datalen,
122 (int)sizeof(struct rpmlead), siglen, pad, datalen);
124 rpmMessage((rc == RPMRC_OK ? RPMMESS_DEBUG : RPMMESS_WARNING),
125 _(" Actual size: %12d\n"), (int)st.st_size);
130 rpmRC rpmReadSignature(FD_t fd, Header * headerp, sigType sig_type)
137 rpmRC rc = RPMRC_FAIL; /* assume failure */
144 case RPMSIGTYPE_NONE:
145 rpmMessage(RPMMESS_DEBUG, _("No signature\n"));
148 case RPMSIGTYPE_PGP262_1024:
149 rpmMessage(RPMMESS_DEBUG, _("Old PGP signature\n"));
150 /* These are always 256 bytes */
151 /*@-type@*/ /* FIX: eliminate timedRead @*/
152 if (timedRead(fd, buf, 256) != 256)
156 (void) headerAddEntry(h, RPMSIGTAG_PGP, RPM_BIN_TYPE, buf, 152);
160 case RPMSIGTYPE_MD5_PGP:
161 rpmError(RPMERR_BADSIGTYPE,
162 _("Old (internal-only) signature! How did you get that!?\n"));
164 case RPMSIGTYPE_HEADERSIG:
165 case RPMSIGTYPE_DISABLE:
166 /* This is a new style signature */
167 h = headerRead(fd, HEADER_MAGIC_YES);
172 sigSize = headerSizeof(h, HEADER_MAGIC_YES);
174 /* XXX Legacy headers have a HEADER_IMAGE tag added. */
175 if (headerIsEntry(h, RPMTAG_HEADERIMAGE))
176 sigSize -= (16 + 16);
178 pad = (8 - (sigSize % 8)) % 8; /* 8-byte pad */
179 if (sig_type == RPMSIGTYPE_HEADERSIG) {
180 if (! headerGetEntry(h, RPMSIGTAG_SIZE, &type,
181 (void **)&archSize, &count))
183 rc = checkSize(fd, sigSize, pad, *archSize);
185 /*@-type@*/ /* FIX: eliminate timedRead @*/
186 if (pad && timedRead(fd, buf, pad) != pad)
187 rc = RPMRC_SHORTREAD;
194 if (headerp && rc == 0)
202 int rpmWriteSignature(FD_t fd, Header h)
204 static byte buf[8] = "\000\000\000\000\000\000\000\000";
208 rc = headerWrite(fd, h, HEADER_MAGIC_YES);
212 sigSize = headerSizeof(h, HEADER_MAGIC_YES);
213 pad = (8 - (sigSize % 8)) % 8;
215 if (Fwrite(buf, sizeof(buf[0]), pad, fd) != pad)
218 rpmMessage(RPMMESS_DEBUG, _("Signature: size(%d)+pad(%d)\n"), sigSize, pad);
222 Header rpmNewSignature(void)
224 Header h = headerNew();
228 Header rpmFreeSignature(Header h)
230 return headerFree(h);
233 static int makePGPSignature(const char * file, /*@out@*/ void ** sig,
234 /*@out@*/ int_32 * size, /*@null@*/ const char * passPhrase)
235 /*@globals rpmGlobalMacroContext,
237 /*@modifies *sig, *size, rpmGlobalMacroContext,
240 char * sigfile = alloca(1024);
245 (void) stpcpy( stpcpy(sigfile, file), ".sig");
247 inpipe[0] = inpipe[1] = 0;
250 if (!(pid = fork())) {
251 const char *pgp_path = rpmExpand("%{_pgp_path}", NULL);
252 const char *name = rpmExpand("+myname=\"%{_pgp_name}\"", NULL);
256 (void) close(STDIN_FILENO);
257 (void) dup2(inpipe[0], 3);
258 (void) close(inpipe[1]);
260 (void) dosetenv("PGPPASSFD", "3", 1);
261 if (pgp_path && *pgp_path != '%')
262 (void) dosetenv("PGPPATH", pgp_path, 1);
264 /* dosetenv("PGPPASS", passPhrase, 1); */
266 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
269 (void) execlp(path, "pgp", "+batchmode=on", "+verbose=0", "+armor=off",
270 name, "-sb", file, sigfile, NULL);
273 (void) execlp(path,"pgps", "+batchmode=on", "+verbose=0", "+armor=off",
274 name, "-b", file, "-o", sigfile, NULL);
277 case PGP_NOTDETECTED:
281 rpmError(RPMERR_EXEC, _("Couldn't exec pgp (%s)\n"),
282 (path ? path : NULL));
286 (void) close(inpipe[0]);
288 (void) write(inpipe[1], passPhrase, strlen(passPhrase));
289 (void) write(inpipe[1], "\n", 1);
290 (void) close(inpipe[1]);
292 (void)waitpid(pid, &status, 0);
293 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
294 rpmError(RPMERR_SIGGEN, _("pgp failed\n"));
298 if (stat(sigfile, &st)) {
299 /* PGP failed to write signature */
300 if (sigfile) (void) unlink(sigfile); /* Just in case */
301 rpmError(RPMERR_SIGGEN, _("pgp failed to write signature\n"));
306 rpmMessage(RPMMESS_DEBUG, _("PGP sig size: %d\n"), *size);
307 *sig = xmalloc(*size);
311 fd = Fopen(sigfile, "r.fdio");
312 if (fd != NULL && !Ferror(fd)) {
313 /*@-type@*/ /* FIX: eliminate timedRead @*/
314 rc = timedRead(fd, *sig, *size);
316 if (sigfile) (void) unlink(sigfile);
321 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
326 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of PGP sig\n"), *size);
331 /* This is an adaptation of the makePGPSignature function to use GPG instead
332 * of PGP to create signatures. I think I've made all the changes necessary,
333 * but this could be a good place to start looking if errors in GPG signature
336 static int makeGPGSignature(const char * file, /*@out@*/ void ** sig,
337 /*@out@*/ int_32 * size, /*@null@*/ const char * passPhrase)
338 /*@globals rpmGlobalMacroContext,
340 /*@modifies *sig, *size, rpmGlobalMacroContext,
343 char * sigfile = alloca(1024);
349 (void) stpcpy( stpcpy(sigfile, file), ".sig");
351 inpipe[0] = inpipe[1] = 0;
354 if (!(pid = fork())) {
355 const char *gpg_path = rpmExpand("%{_gpg_path}", NULL);
356 const char *name = rpmExpand("%{_gpg_name}", NULL);
358 (void) close(STDIN_FILENO);
359 (void) dup2(inpipe[0], 3);
360 (void) close(inpipe[1]);
362 if (gpg_path && *gpg_path != '%')
363 (void) dosetenv("GNUPGHOME", gpg_path, 1);
364 (void) execlp("gpg", "gpg",
365 "--batch", "--no-verbose", "--no-armor", "--passphrase-fd", "3",
366 "-u", name, "-sbo", sigfile, file,
368 rpmError(RPMERR_EXEC, _("Couldn't exec gpg\n"));
372 fpipe = fdopen(inpipe[1], "w");
373 (void) close(inpipe[0]);
375 fprintf(fpipe, "%s\n", (passPhrase ? passPhrase : ""));
376 (void) fclose(fpipe);
379 (void)waitpid(pid, &status, 0);
380 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
381 rpmError(RPMERR_SIGGEN, _("gpg failed\n"));
385 if (stat(sigfile, &st)) {
386 /* GPG failed to write signature */
387 if (sigfile) (void) unlink(sigfile); /* Just in case */
388 rpmError(RPMERR_SIGGEN, _("gpg failed to write signature\n"));
393 rpmMessage(RPMMESS_DEBUG, _("GPG sig size: %d\n"), *size);
394 *sig = xmalloc(*size);
398 fd = Fopen(sigfile, "r.fdio");
399 if (fd != NULL && !Ferror(fd)) {
400 /*@-type@*/ /* FIX: eliminate timedRead @*/
401 rc = timedRead(fd, *sig, *size);
403 if (sigfile) (void) unlink(sigfile);
408 rpmError(RPMERR_SIGGEN, _("unable to read the signature\n"));
413 rpmMessage(RPMMESS_DEBUG, _("Got %d bytes of GPG sig\n"), *size);
418 int rpmAddSignature(Header h, const char * file, int_32 sigTag,
419 const char *passPhrase)
429 (void) stat(file, &st);
432 (void) headerAddEntry(h, RPMSIGTAG_SIZE, RPM_INT32_TYPE, &size, 1);
435 ret = mdbinfile(file, buf);
437 (void) headerAddEntry(h, sigTag, RPM_BIN_TYPE, buf, 16);
439 case RPMSIGTAG_PGP5: /* XXX legacy */
441 rpmMessage(RPMMESS_VERBOSE, _("Generating signature using PGP.\n"));
442 ret = makePGPSignature(file, &sig, &size, passPhrase);
444 (void) headerAddEntry(h, sigTag, RPM_BIN_TYPE, sig, size);
447 rpmMessage(RPMMESS_VERBOSE, _("Generating signature using GPG.\n"));
448 ret = makeGPGSignature(file, &sig, &size, passPhrase);
450 (void) headerAddEntry(h, sigTag, RPM_BIN_TYPE, sig, size);
457 static int checkPassPhrase(const char * passPhrase, const int sigTag)
458 /*@globals rpmGlobalMacroContext,
460 /*@modifies rpmGlobalMacroContext,
463 int passPhrasePipe[2];
467 passPhrasePipe[0] = passPhrasePipe[1] = 0;
468 (void) pipe(passPhrasePipe);
469 if (!(pid = fork())) {
470 (void) close(STDIN_FILENO);
471 (void) close(STDOUT_FILENO);
472 (void) close(passPhrasePipe[1]);
473 /*@-internalglobs@*/ /* FIX: shrug */
474 if (! rpmIsVerbose()) {
475 (void) close(STDERR_FILENO);
478 if ((fd = open("/dev/null", O_RDONLY)) != STDIN_FILENO) {
479 (void) dup2(fd, STDIN_FILENO);
482 if ((fd = open("/dev/null", O_WRONLY)) != STDOUT_FILENO) {
483 (void) dup2(fd, STDOUT_FILENO);
486 (void) dup2(passPhrasePipe[0], 3);
490 { const char *gpg_path = rpmExpand("%{_gpg_path}", NULL);
491 const char *name = rpmExpand("%{_gpg_name}", NULL);
492 if (gpg_path && *gpg_path != '%')
493 (void) dosetenv("GNUPGHOME", gpg_path, 1);
494 (void) execlp("gpg", "gpg",
495 "--batch", "--no-verbose", "--passphrase-fd", "3",
496 "-u", name, "-so", "-",
498 rpmError(RPMERR_EXEC, _("Couldn't exec gpg\n"));
500 } /*@notreached@*/ break;
501 case RPMSIGTAG_PGP5: /* XXX legacy */
503 { const char *pgp_path = rpmExpand("%{_pgp_path}", NULL);
504 const char *name = rpmExpand("+myname=\"%{_pgp_name}\"", NULL);
508 (void) dosetenv("PGPPASSFD", "3", 1);
509 if (pgp_path && *pgp_path != '%')
510 (void) dosetenv("PGPPATH", pgp_path, 1);
512 if ((path = rpmDetectPGPVersion(&pgpVer)) != NULL) {
515 (void) execlp(path, "pgp", "+batchmode=on", "+verbose=0",
517 /*@innerbreak@*/ break;
518 case PGP_5: /* XXX legacy */
519 (void) execlp(path,"pgps", "+batchmode=on", "+verbose=0",
521 /*@innerbreak@*/ break;
523 case PGP_NOTDETECTED:
524 /*@innerbreak@*/ break;
527 rpmError(RPMERR_EXEC, _("Couldn't exec pgp\n"));
529 } /*@notreached@*/ break;
530 default: /* This case should have been screened out long ago. */
531 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
532 _exit(RPMERR_SIGGEN);
533 /*@notreached@*/ break;
537 (void) close(passPhrasePipe[0]);
538 (void) write(passPhrasePipe[1], passPhrase, strlen(passPhrase));
539 (void) write(passPhrasePipe[1], "\n", 1);
540 (void) close(passPhrasePipe[1]);
542 (void)waitpid(pid, &status, 0);
543 if (!WIFEXITED(status) || WEXITSTATUS(status)) {
547 /* passPhrase is good */
551 char * rpmGetPassPhrase(const char * prompt, const int sigTag)
558 { const char *name = rpmExpand("%{_gpg_name}", NULL);
559 aok = (name && *name != '%');
563 rpmError(RPMERR_SIGGEN,
564 _("You must set \"%%_gpg_name\" in your macro file\n"));
568 case RPMSIGTAG_PGP5: /* XXX legacy */
570 { const char *name = rpmExpand("%{_pgp_name}", NULL);
571 aok = (name && *name != '%');
575 rpmError(RPMERR_SIGGEN,
576 _("You must set \"%%_pgp_name\" in your macro file\n"));
581 /* Currently the calling function (rpm.c:main) is checking this and
582 * doing a better job. This section should never be accessed.
584 rpmError(RPMERR_SIGGEN, _("Invalid %%_signature spec in macro file\n"));
586 /*@notreached@*/ break;
589 pass = /*@-unrecog@*/ getpass( (prompt ? prompt : "") ) /*@=unrecog@*/ ;
591 if (checkPassPhrase(pass, sigTag))
597 static rpmVerifySignatureReturn
598 verifySizeSignature(/*@unused@*/ const char * fn,
600 /*@unused@*/ int siglen,
601 const rpmDigest dig, /*@out@*/ char * result)
602 /*@modifies *result @*/
605 int_32 size = *(int_32 *)sig;
609 t = stpcpy(t, "Header+Payload size: ");
612 if (size != dig->nbytes) {
614 sprintf(t, "BAD Expected(%d) != (%d)\n", size, dig->nbytes);
617 sprintf(t, "OK (%d)\n", dig->nbytes);
624 static rpmVerifySignatureReturn
625 verifyMD5Signature(/*@unused@*/ const char * fn, const byte * sig, int siglen,
626 const rpmDigest dig, /*@out@*/ char * result)
627 /*@modifies *result @*/
630 byte * md5sum = NULL;
635 (void) rpmDigestFinal(rpmDigestDup(dig->md5ctx),
636 (void **)&md5sum, &md5len, 0);
640 t = stpcpy(t, "MD5 digest: ");
642 if (md5len != siglen || memcmp(md5sum, sig, md5len)) {
644 t = stpcpy(t, "BAD Expected(");
645 (void) pgpHexCvt(t, sig, siglen);
647 t = stpcpy(t, ") != (");
650 t = stpcpy(t, "OK (");
652 (void) pgpHexCvt(t, md5sum, md5len);
654 t = stpcpy(t, ")\n");
656 md5sum = _free(md5sum);
661 static rpmVerifySignatureReturn
662 verifyPGPSignature(/*@unused@*/ const char * fn,
663 /*@unused@*/ const byte * sig,
664 /*@unused@*/ int siglen,
665 const rpmDigest dig, /*@out@*/ char * result)
666 /*@modifies *result */
672 t = stpcpy(t, "V3 RSA/MD5 signature: ");
675 if (!rsavrfy(&dig->rsa_pk, &dig->rsahm, &dig->c)) {
677 t = stpcpy(t, "BAD\n");
680 t = stpcpy(t, "OK\n");
687 static rpmVerifySignatureReturn
688 verifyGPGSignature(/*@unused@*/ const char * fn,
689 /*@unused@*/ const byte * sig,
690 /*@unused@*/ int siglen,
691 const rpmDigest dig, /*@out@*/ char * result)
692 /*@modifies *result @*/
698 t = stpcpy(t, "V3 DSA signature: ");
701 if (!dsavrfy(&dig->p, &dig->q, &dig->g, &dig->hm, &dig->y, &dig->r, &dig->s)) {
703 t = stpcpy(t, "BAD\n");
706 t = stpcpy(t, "OK\n");
713 rpmVerifySignatureReturn
714 rpmVerifySignature(const char * fn, int_32 sigTag, const void * sig,
715 int siglen, const rpmDigest dig, char * result)
720 res = verifySizeSignature(fn, sig, siglen, dig, result);
723 res = verifyMD5Signature(fn, sig, siglen, dig, result);
725 case RPMSIGTAG_PGP5: /* XXX legacy */
727 res = verifyPGPSignature(fn, sig, siglen, dig, result);
730 res = verifyGPGSignature(fn, sig, siglen, dig, result);
732 case RPMSIGTAG_LEMD5_1:
733 case RPMSIGTAG_LEMD5_2:
734 sprintf(result, "Broken MD5 digest: UNSUPPORTED\n");
735 res = RPMSIG_UNKNOWN;
738 sprintf(result, "Signature: UNKNOWN(%d)\n", sigTag);
739 res = RPMSIG_UNKNOWN;