From a2baa7089ed51fc525ed021a367cb50f2d06d3d2 Mon Sep 17 00:00:00 2001
From: Matthew Johnson <matthew.johnson@intel.com>
Date: Thu, 12 Jan 2017 15:05:14 -0800
Subject: [PATCH] Add package signature as Source99 file

Add the package signature URL as a Source99 file to include it with the
source rpm. This allows the signature to be more traceable and
accessible even without a network connection.
---
 autospec/config.py          |  1 +
 autospec/pkg_integrity.py   | 25 ++++++++++++++++++-------
 autospec/specfiles.py       |  4 ++++
 tests/test_pkg_integrity.py |  6 ++++--
 4 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/autospec/config.py b/autospec/config.py
index 409a9ef..4193c11 100644
--- a/autospec/config.py
+++ b/autospec/config.py
@@ -61,6 +61,7 @@ config_file = None
 old_version = None
 old_patches = list()
 profile_payload = None
+signature = None
 
 failed_commands = {}
 maven_jars = {}
diff --git a/autospec/pkg_integrity.py b/autospec/pkg_integrity.py
index 9086061..6f79ab0 100644
--- a/autospec/pkg_integrity.py
+++ b/autospec/pkg_integrity.py
@@ -178,10 +178,19 @@ class GPGVerifier(Verifier):
         Verifier.__init__(self, **kwargs)
         self.key_url = kwargs.get('key_url', None)
         self.package_path = kwargs.get('package_path', None)
-        if self.key_url is None and self.url is not None:
+        self.package_check = kwargs.get('package_check', None)
+        if not self.key_url and self.package_check:
+            # signature exists locally, don't try to download self.url
+            self.key_url = self.url.rstrip('/') + get_file_ext(self.package_check)
+        if not self.key_url and self.url:
+            # signature does not exist locally, find signature url from self.url,
+            # may require a HEAD request.
             self.key_url = get_signature_url(self.url)
-        if self.package_sign_path is None:
-            self.package_sign_path = self.package_path + '.asc'
+        if not self.package_sign_path:
+            # the key exists (or will exist) at
+            # <package directory>/<key url basename>
+            self.package_sign_path = os.path.join(os.path.dirname(self.package_path),
+                                                  os.path.basename(self.key_url))
 
     def get_pubkey_path(self):
         keyid = get_keyid(self.package_sign_path)
@@ -228,6 +237,7 @@ class GPGVerifier(Verifier):
         if sign_status is None:
             self.print_result(self.package_path)
             KEYID = KEYID_TRY
+            config.signature = self.key_url
             config.config_opts['verify_required'] = True
             config.rewrite_config_opts()
             return True
@@ -390,11 +400,12 @@ def from_url(url, download_path):
                               'url': url, })
 
 
-def from_disk(package_path, package_check):
+def from_disk(url, package_path, package_check):
     verifier = get_verifier(package_path)
     return apply_verification(verifier, **{
                               'package_path': package_path,
-                              'package_check': package_check, })
+                              'package_check': package_check,
+                              'url': url,  })
 
 
 def get_integrity_file(package_path):
@@ -415,7 +426,7 @@ def check(url, download_path):
     print(SEPT)
     print('Performing package integrity verification\n')
     if package_check is not None:
-        return from_disk(package_path, package_check)
+        return from_disk(url, package_path, package_check)
     elif package_path[-4:] == '.gem':
         return from_url(url, download_path)
     else:
@@ -447,7 +458,7 @@ def load_specfile(specfile):
 
 
 def main(args):
-    from_disk(args.tar, args.sig)
+    from_disk(args.url, args.tar, args.sig)
 
 
 if __name__ == '__main__':
diff --git a/autospec/specfiles.py b/autospec/specfiles.py
index 9f3892a..eb3e82c 100644
--- a/autospec/specfiles.py
+++ b/autospec/specfiles.py
@@ -161,6 +161,10 @@ class Specfile(object):
             self.source_index[source] = count + 1
             self._write("Source{0}  : {1}\n".format(count + 1, source))
 
+        # if package is verified, include the signature in the source tarball
+        if self.keyid and config.signature:
+            self._write_strip("Source99 : {}".format(config.signature))
+
     def write_summary(self):
         """
         Write package summary to spec file
diff --git a/tests/test_pkg_integrity.py b/tests/test_pkg_integrity.py
index 98fcc4b..b8958f7 100644
--- a/tests/test_pkg_integrity.py
+++ b/tests/test_pkg_integrity.py
@@ -98,7 +98,7 @@ class TestGPGVerifier(unittest.TestCase):
             out_key = out_file + '.asc'
             pkg_integrity.attempt_to_download(ALEMBIC_PKT_URL, out_file)
             pkg_integrity.attempt_to_download(ALEMBIC_PKT_URL + '.asc', out_key)
-            result = pkg_integrity.from_disk(out_file, out_key)
+            result = pkg_integrity.from_disk(ALEMBIC_PKT_URL, out_file, out_key)
             self.assertTrue(result)
 
     def test_non_matchingsig(self):
@@ -112,7 +112,9 @@ class TestGPGVerifier(unittest.TestCase):
             self.assertEqual(a.exception.code, 1)
 
     def test_result_on_non_existent_pkg_path(self):
-        result = pkg_integrity.from_disk('NonExistentPKG.tar.gz', 'NonExistentKey.asc')
+        result = pkg_integrity.from_disk('http://nokey.com/package.tar.gz',
+                                         'NonExistentPKG.tar.gz',
+                                         'NonExistentKey.asc')
         self.assertTrue(result is None)
 
     def test_result_on_nosign_package(self):