[patch] Merge gpg support from emerge-webrsync

Merge-gpg-support-from-emerge-webrsync.patch (text/plain), 4.26 KB, created by Zac Medico on 2012-08-14 02:06:43 UTC

From 33a2b1abf9c2b42dd2c08ef130c2d0e5963a11fd Mon Sep 17 00:00:00 2001
From: Zac Medico <[e-mail]>
Date: Mon, 13 Aug 2012 18:33:24 -0700
Subject: [PATCH] Merge gpg support from emerge-webrsync.

---
 emerge-delta-webrsync |   66 ++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 62 insertions(+), 4 deletions(-)

diff --git a/emerge-delta-webrsync b/emerge-delta-webrsync
index 14e91dc..bbc3f9e 100644
--- a/emerge-delta-webrsync
+++ b/emerge-delta-webrsync
@@ -4,11 +4,16 @@
 # Author: Brian Harring <[e-mail]>, [e-mail] originally.
 # Rewritten from the old, Perl-based emerge-webrsync script
 
+argv0=$0
+
+# error echos
+eecho() { echo "${argv0}: error: $*" 1>&2 ; }
+
 #-------------------
 #initialization
 #------------------
 
-f=$(python -c 'import portage, sys; sys.stdout.write("|".join([portage.settings[x] for x in ("PORTAGE_NICENESS", "FEATURES", "GENTOO_MIRRORS", "PORTDIR", "FETCHCOMMAND", "USERLAND", "DISTDIR", "PORTAGE_TMPDIR")]))')
+f=$(python -c 'import portage, sys; sys.stdout.write("|".join([portage.settings[x] for x in ("PORTAGE_NICENESS", "FEATURES", "GENTOO_MIRRORS", "PORTDIR", "FETCHCOMMAND", "USERLAND", "DISTDIR", "PORTAGE_GPG_DIR", "PORTAGE_TMPDIR")]))')
 
 IFS='|'
 PORTAGE_NICENESS="${f%%|*}";	f="${f#*|}"
@@ -18,6 +23,7 @@ PORTDIR="${f%%|*}"	 ;		f="${f#*|}"
 FETCHCOMMAND="${f%%|*}"	 ;		f="${f#*|}"
 USERLAND="${f%%|*}"	 ;		f="${f#*|}"
 DISTDIR="${f%%|*}"	 ;		f="${f#*|}"
+PORTAGE_GPG_DIR="${f%%|*}"	 ;		f="${f#*|}"
 TMPDIR="${f%%|*}/snapshots"
 unset IFS
 
@@ -45,6 +51,12 @@ unset IFS
 MUST_SYNC='1'
 unset PUKE_HELP wgetops
 for x in $*; do
+	case "${x}" in
+		-q|--quiet)
+			PORTAGE_QUIET=1
+			continue
+			;;
+	esac
 	if [[ $x == "-u" ]]; then
 		MUST_SYNC=''
 	elif [[ $x == "-k" ]]; then
@@ -69,6 +81,16 @@ if [[ ! -d $STATE_DIR ]]; then
 	exit -2
 fi
 
+if has webrsync-gpg ${FEATURES} ; then
+	WEBSYNC_VERIFY_SIGNATURE=1
+else
+	WEBSYNC_VERIFY_SIGNATURE=0
+fi
+if [ ${WEBSYNC_VERIFY_SIGNATURE} != 0 -a -z "${PORTAGE_GPG_DIR}" ]; then
+	eecho "please set PORTAGE_GPG_DIR in make.conf"
+	exit 1
+fi
+
 if [[ ! -d $DISTDIR ]] ; then
 	mkdir -p $DISTDIR
 fi
@@ -269,6 +291,27 @@ verify_md5_file() {
 	fi
 }
 
+check_file_signature() {
+	local signature="$1"
+	local file="$2"
+	local r=1
+
+	if [[ ${WEBSYNC_VERIFY_SIGNATURE} != 0 ]] ; then
+
+		vecho "Checking signature ..."
+
+		if type -P gpg > /dev/null; then
+			gpg --homedir "${PORTAGE_GPG_DIR}" --verify "$signature" "$file" && r=0
+		else
+			eecho "cannot check signature: gpg binary not found"
+			exit 1
+		fi
+	else
+		r=0
+	fi
+
+	return "${r}"
+}
 
 #--------------------
 #inline actual script
@@ -428,7 +471,14 @@ else
 		got_umd5=1
 	fi
 fi
-	
+
+if [[ ${WEBSYNC_VERIFY_SIGNATURE} == 1 && ! -e portage-${final_date}.tar.bz2.gpgsig ]] && \
+	! fetch_from_mirrors "/snapshots/portage-${final_date}.tar.bz2.gpgsig" "portage-${final_date}.tar.bz2.gpgsig" ; then
+	echo "warning... couldn't grab the gpgsig for ${final_date}.  which is odd"
+	echo "thus, bailing (sorry)"
+	exit 5
+fi
+
 # generate tmp dir.
 TEMPDIR=$(mktemp -d /tmp/delta-webrsync-XXXXXX)
 # got our patches.
@@ -454,7 +504,12 @@ unset need_last_sync
 if [ "$verified" == "1" ]; then
 	echo "recompressing. (backgrounding)"
 	need_last_sync="dar"
-	bzip2 -vk9 "${TEMPDIR}/portage-${final_date}.tar" &
+	if [[ ${WEBSYNC_VERIFY_SIGNATURE} == 1 ]] ; then
+		bzip2 -vk9 "${TEMPDIR}/portage-${final_date}.tar"
+		check_file_signature "${DISTDIR}/portage-${final_date}.tar.bz2.gpgsig" "${TEMPDIR}/portage-${final_date}.tar.bz2" || exit 1
+	else
+		bzip2 -vk9 "${TEMPDIR}/portage-${final_date}.tar" &
+	fi
 
 	echo "beginning update to the tree"
 	sync_local "${TEMPDIR}/portage-${final_date}.tar"
@@ -496,6 +551,9 @@ else
 fi
 
 if [ -z "${need_last_sync}" ]; then
+	if [[ ${WEBSYNC_VERIFY_SIGNATURE} == 1 ]] ; then
+		check_file_signature "${DISTDIR}/portage-${final_date}.tar.bz2.gpgsig" "${dfile}" || exit 1
+	fi
 	echo "beginning update to the tree"
 	sync_local "${dfile}"
 fi
@@ -504,7 +562,7 @@ if [[ -z $KEEP_OLDIES ]]; then
 	echo "cleansing"
 	for x in $potentials; do
 		echo "removing ${x}"
-		rm "${DISTDIR}/${x}" "${DISTDIR}/${x}.md5sum" &> /dev/null
+		rm "${DISTDIR}/${x}"{,.md5sum,.umd5sum,.gpgsig} &> /dev/null
 		rm "${STATE_DIR}/${x}" "${STATE_DIR}/${x}.md5sum" "${STATE_DIR}/${x}.umd5sum" &> /dev/null
 	done
 fi
-- 
1.7.9.7