Check for public key consistency in verification step

Autospec should show an error and exit if the key the package was
verified with has changed from previous autospec runs, as it may
indicate a compromised key. The previous key is recorded in the existing
spec file.

autospec/config.py

@@ -60,6 +60,7 @@ git_uri = None
 config_file = None
 old_version = None
 old_patches = list()
+old_keyid = None
 profile_payload = None
 signature = None
 
@@ -188,6 +189,7 @@ def setup_patterns():
 def parse_existing_spec(path, name):
     global old_version
     global old_patches
+    global old_keyid
 
     spec = os.path.join(path, "{}.spec".format(name))
     if not os.path.exists(spec):
@@ -196,6 +198,9 @@ def parse_existing_spec(path, name):
     with open(spec, "r", encoding="latin-1") as inp:
         for line in inp.readlines():
             line = line.strip().replace("\r", "").replace("\n", "")
+            if "Source0 file verified with key" in line:
+                keyidx = line.find('0x') + 2
+                old_keyid = line[keyidx:].split()[0] if keyidx > 2 else old_keyid
             if ":" not in line:
                 continue
             spl = line.split(":")

autospec/pkg_integrity.py

@@ -212,6 +212,17 @@ def get_signature_url(package_url):
     return None
 
 
+def compare_keys(newkey, oldkey):
+    if newkey != oldkey:
+        print_error('Public key has changed:\n'
+                    '            old key: {}\n'
+                    '            new key: {}\n'
+                    'this is a critical security error, quitting...'
+                    .format(oldkey, newkey))
+        exit(1)
+
+
+
 # GPG Verification
 class GPGVerifier(Verifier):
 
@@ -279,6 +290,8 @@ class GPGVerifier(Verifier):
             return None
         sign_status = verify_cli(pub_key, self.package_path, self.package_sign_path)
         if sign_status is None:
+            if config.old_keyid:
+                compare_keys(KEYID_TRY, config.old_keyid)
             self.print_result(self.package_path)
             KEYID = KEYID_TRY
             config.signature = self.key_url