Fix tpk reinstall mode signature checking

Submit together:
 - https://review.tizen.org/gerrit/#/c/85692/
 - https://review.tizen.org/gerrit/#/c/85693/

Change-Id: I7ffa34adabc89c8e5c19428eda1729318f90c5ee

diff --git a/src/common/certificate_validation.cc b/src/common/certificate_validation.cc
index 4948545..23f9df4 100644 (file)
--- a/src/common/certificate_validation.cc
+++ b/src/common/certificate_validation.cc
@@ -137,11 +137,12 @@ bool ValidateSignatureFile(
 
   ValidationCore::SignatureValidator validator(file_info);
   ValidationCore::SignatureData data;
-  ValidationCore::VCerr result = validator.check(
-      base_path.string(),  // app content path for checking hash of file ref.
-      true,                // ocsp check flag
-      check_reference,     // file reference hash check flag
-      data);               // output signature data
+  ValidationCore::VCerr result;
+  if (check_reference) {
+    result = validator.check(base_path.string(), true, true, data);
+  } else {
+    result = validator.checkList(true, ValidationCore::UriList(), data);
+  }
 
   std::string errnum = boost::str(boost::format("%d") % result);
   *error_message = validator.errorToString(result);

diff --git a/src/common/step/security/step_check_signature.cc b/src/common/step/security/step_check_signature.cc
index ffefc06..6ddcc98 100644 (file)
--- a/src/common/step/security/step_check_signature.cc
+++ b/src/common/step/security/step_check_signature.cc
@@ -104,9 +104,10 @@ Step::Status StepCheckSignature::CheckPrivilegeLevel(PrivilegeLevel level) {
 Step::Status StepCheckSignature::process() {
   PrivilegeLevel level = PrivilegeLevel::UNTRUSTED;
   bool check_reference = true;
-  if (getuid() == 0 &&
+  if (context_->request_type.get() == ci::RequestType::Reinstall ||
+      (getuid() == 0 &&
       (context_->request_type.get() == ci::RequestType::ManifestDirectInstall ||
-      context_->request_type.get() == ci::RequestType::ManifestDirectUpdate))
+      context_->request_type.get() == ci::RequestType::ManifestDirectUpdate)))
     check_reference = false;
   bool is_preload = context_->is_preload_request.get();
   Status status = CheckSignatures(check_reference, is_preload, &level);

diff --git a/src/common/step/security/step_privilege_compatibility.cc b/src/common/step/security/step_privilege_compatibility.cc
index 6522845..ca9cfe1 100644 (file)
--- a/src/common/step/security/step_privilege_compatibility.cc
+++ b/src/common/step/security/step_privilege_compatibility.cc
@@ -85,13 +85,8 @@ Step::Status StepPrivilegeCompatibility::process() {
                         strdup(common::privileges::kPrivForPlatform));
       break;
     default:
-      // At this stage we should have defined privilege level and
-      // untrusted packages are not accepted anymore.
-      // TODO(t.iwanek): report error here when reinstall tpk mode is fixed
-      context_->manifest_data.get()->privileges =
-              g_list_append(context_->manifest_data.get()->privileges,
-                            strdup(common::privileges::kPrivForPublic));
-      break;
+      LOG(ERROR) << "Untrusted package are not suppored anymore";
+      return Status::PRIVILEGE_ERROR;
   }
   if (!ret) {
     LOG(ERROR) << "Error during adding default privileges for certificates.";