Fail installation if certificate comparision fails

Change-Id: Ie07c7361d057b0d4eabc7e576719fce1152994c3

diff --git a/src/common/pkgmgr_registration.cc b/src/common/pkgmgr_registration.cc
index c54970b..422f10c 100644 (file)
--- a/src/common/pkgmgr_registration.cc
+++ b/src/common/pkgmgr_registration.cc
@@ -191,13 +191,13 @@ std::string QueryCertificateAuthorCertificate(const std::string& pkgid,
   pkgmgrinfo_certinfo_h handle;
   int ret = pkgmgrinfo_pkginfo_create_certinfo(&handle);
   if (ret != PMINFO_R_OK) {
-    LOG(ERROR) << "pkgmgrinfo_pkginfo_create_certinfo failed with error: "
+    LOG(DEBUG) << "pkgmgrinfo_pkginfo_create_certinfo failed with error: "
                << ret;
     return {};
   }
   ret = pkgmgrinfo_pkginfo_load_certinfo(pkgid.c_str(), handle, uid);
   if (ret != PMINFO_R_OK) {
-    LOG(ERROR) << "pkgmgrinfo_pkginfo_load_certinfo failed with error: " << ret;
+    LOG(DEBUG) << "pkgmgrinfo_pkginfo_load_certinfo failed with error: " << ret;
     pkgmgrinfo_pkginfo_destroy_certinfo(handle);
     return {};
   }
@@ -205,7 +205,7 @@ std::string QueryCertificateAuthorCertificate(const std::string& pkgid,
   ret = pkgmgrinfo_pkginfo_get_cert_value(handle, PMINFO_AUTHOR_SIGNER_CERT,
                                           &author_cert);
   if (ret != PMINFO_R_OK) {
-    LOG(ERROR) << "pkgmgrinfo_pkginfo_get_cert_value failed with error: "
+    LOG(DEBUG) << "pkgmgrinfo_pkginfo_get_cert_value failed with error: "
                << ret;
     pkgmgrinfo_pkginfo_destroy_certinfo(handle);
     return {};

diff --git a/src/common/step/step_check_old_certificate.cc b/src/common/step/step_check_old_certificate.cc
index 7a3682d..91f70c5 100644 (file)
--- a/src/common/step/step_check_old_certificate.cc
+++ b/src/common/step/step_check_old_certificate.cc
@@ -21,6 +21,7 @@ Step::Status StepCheckOldCertificate::process() {
       QueryCertificateAuthorCertificate(context_->pkgid.get(),
                                         context_->uid.get());
   const auto& cert = context_->certificate_info.get().author_certificate.get();
+
   if (!old_author_certificate.empty()) {
     if (!cert) {
       LOG(ERROR) << "Trying to update package without signature is not allowed "

diff --git a/src/common/step/step_check_signature.cc b/src/common/step/step_check_signature.cc
index 42c4ac3..a6a1af1 100644 (file)
--- a/src/common/step/step_check_signature.cc
+++ b/src/common/step/step_check_signature.cc
@@ -19,11 +19,25 @@
 #include <string>
 
 #include "common/utils/glist_range.h"
+#include "common/pkgmgr_registration.h"
 
 namespace bf = boost::filesystem;
+namespace ci = common_installer;
 
 namespace {
 
+bool CheckPkgCertificateMismatch(const std::string& pkgid,
+                                 const std::string& old_certificate) {
+  bool certificate_mismatch = false;
+  uid_t uid = G_MAXUINT;
+  auto certificate = ci::QueryCertificateAuthorCertificate(pkgid, uid);
+
+  if (!certificate.empty()) {
+    certificate_mismatch = (old_certificate != certificate);
+  }
+  return certificate_mismatch;
+}
+
 common_installer::PrivilegeLevel CertStoreIdToPrivilegeLevel(
     ValidationCore::CertStoreId::Type id) {
   switch (id) {
@@ -197,10 +211,23 @@ Step::Status StepCheckSignature::process() {
       ValidateSignatures(context_->unpacked_dir_path.get(), &level,
                          &context_->certificate_info.get(), &error_message);
   if (status != Status::OK) {
-    LOG(ERROR) << "error_message: " << error_message;
     on_error(status, error_message);
     return status;
   }
+
+  const auto& cert = context_->certificate_info.get().author_certificate.get();
+  if (cert) {
+    bool certificate_mismatch =
+        CheckPkgCertificateMismatch(context_->pkgid.get(), cert->getBase64());
+    if (certificate_mismatch) {
+      std::string error_message =
+          "Package with the same id and different certificate "
+          "has been already installed";
+      on_error(Status::CERT_ERROR, error_message);
+      return Status::CERT_ERROR;
+    }
+  }
+
   LOG(INFO) << "Privilege level: " << PrivilegeLevelToString(level);
   context_->privilege_level.set(level);