From fcf7f8a1b53fea0acbfd18f9abe2344e1d9fc7df Mon Sep 17 00:00:00 2001 From: Matthew Johnson Date: Thu, 5 Jan 2017 15:39:06 -0800 Subject: [PATCH] Add verify_required config option and set after verify verify_required requires the package to be verified for the build to continue. If a package is ever verified, this configuration is automatically set to prevent future regressions. If a regression does occur in the future but there is a valid reason, a developer must manually unset the verify_require flag to build the package. This is a safety mechanism. --- autospec/config.py | 3 ++- autospec/pkg_integrity.py | 14 ++++++++++++++ tests/testfiles/c-helloworld-32/conf-expectations | 2 ++ .../testfiles/c-helloworld-opts/conf-expectations | 2 ++ tests/testfiles/c-helloworld/conf-expectations | 2 ++ tests/testfiles/libjpeg-turbo/conf-expectations | 2 ++ tests/testfiles/py-helloworld/conf-expectations | 2 ++ 7 files changed, 26 insertions(+), 1 deletion(-) diff --git a/autospec/config.py b/autospec/config.py index 4c47474..409a9ef 100644 --- a/autospec/config.py +++ b/autospec/config.py @@ -84,7 +84,8 @@ config_options = { "broken_parallel_build": "disable parallelization during build", "pgo": "set profile for pgo", "use_clang": "add clang flags", - "32bit" : "build 32 bit libraries"} + "32bit" : "build 32 bit libraries", + "verify_required": "require package verification for build"} def create_conf(): config_f = configparser.ConfigParser(allow_no_value=True) diff --git a/autospec/pkg_integrity.py b/autospec/pkg_integrity.py index 32c7812..04034fd 100644 --- a/autospec/pkg_integrity.py +++ b/autospec/pkg_integrity.py @@ -12,6 +12,8 @@ from io import BytesIO from contextlib import contextmanager from subprocess import Popen, PIPE +import config + GPG_CLI = False DESCRIPTION = "Performs package signature verification for packages signed with\ gpg." @@ -201,25 +203,37 @@ class GPGVerifier(Verifier): print("Verifying GPG signature\n") if os.path.exists(self.package_path) is False: self.print_result(False, err_msg='{} not found'.format(self.package_path)) + if config.config_opts['verify_required']: + self.quit_verify() return None if os.path.exists(self.package_sign_path) is False and self.get_sign() is not True: self.print_result(False, err_msg='{} not found'.format(self.package_sign_path)) + if config.config_opts['verify_required']: + self.quit_verify() return None pub_key = self.get_pubkey_path() EMAIL = parse_key(pub_key, r':user ID packet: ".* <(.+?)>"\n') if not pub_key or os.path.exists(pub_key) is False: key_id = get_keyid(self.package_sign_path) self.print_result(False, 'Public key {} not found in keyring'.format(key_id)) + if config.config_opts['verify_required']: + self.quit_verify() return None sign_status = verify_cli(pub_key, self.package_path, self.package_sign_path) if sign_status is None: self.print_result(self.package_path) KEYID = KEYID_TRY + config.config_opts['verify_required'] = True + config.rewrite_config_opts() return True else: self.print_result(False, err_msg=sign_status.strerror) self.quit() + def quit_verify(self): + print_error("verification required for build (verify_required option set)") + self.quit() + # GEM Verifier class GEMShaVerifier(Verifier): diff --git a/tests/testfiles/c-helloworld-32/conf-expectations b/tests/testfiles/c-helloworld-32/conf-expectations index 60239ca..6894683 100644 --- a/tests/testfiles/c-helloworld-32/conf-expectations +++ b/tests/testfiles/c-helloworld-32/conf-expectations @@ -33,4 +33,6 @@ use_avx2 = false use_clang = false # configure build for lto use_lto = false +# require package verification for build +verify_required = false diff --git a/tests/testfiles/c-helloworld-opts/conf-expectations b/tests/testfiles/c-helloworld-opts/conf-expectations index 9ffc4e2..8704ec2 100644 --- a/tests/testfiles/c-helloworld-opts/conf-expectations +++ b/tests/testfiles/c-helloworld-opts/conf-expectations @@ -33,4 +33,6 @@ use_avx2 = false use_clang = false # configure build for lto use_lto = true +# require package verification for build +verify_required = false diff --git a/tests/testfiles/c-helloworld/conf-expectations b/tests/testfiles/c-helloworld/conf-expectations index caba8c6..788a3b0 100644 --- a/tests/testfiles/c-helloworld/conf-expectations +++ b/tests/testfiles/c-helloworld/conf-expectations @@ -33,4 +33,6 @@ use_avx2 = false use_clang = false # configure build for lto use_lto = false +# require package verification for build +verify_required = false diff --git a/tests/testfiles/libjpeg-turbo/conf-expectations b/tests/testfiles/libjpeg-turbo/conf-expectations index ef03910..d1bd363 100644 --- a/tests/testfiles/libjpeg-turbo/conf-expectations +++ b/tests/testfiles/libjpeg-turbo/conf-expectations @@ -33,4 +33,6 @@ use_avx2 = false use_clang = false # configure build for lto use_lto = false +# require package verification for build +verify_required = false diff --git a/tests/testfiles/py-helloworld/conf-expectations b/tests/testfiles/py-helloworld/conf-expectations index caba8c6..788a3b0 100644 --- a/tests/testfiles/py-helloworld/conf-expectations +++ b/tests/testfiles/py-helloworld/conf-expectations @@ -33,4 +33,6 @@ use_avx2 = false use_clang = false # configure build for lto use_lto = false +# require package verification for build +verify_required = false