clearlinux/swupd-server
2
0
Fork 0
mirror of https://github.com/clearlinux/swupd-server.git synced 2026-08-19 04:57:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove all signature creation code

Browse Source 
Since the enablement of signature verification in swupd-client, the
signature creation step has been decoupled from swupd-server, and is
instead performed as a separate step in a DevOps flow.  As a result of
this decoupling, the signature code in swupd-server has remained unused.

This commit removes all the signature creation code with the assumption
that the separate DevOps step is going to work better long-term. Also,
the existing signature creation support does not accord with
swupd-client's verification support.

An example of how Manifest.MoM files can be signed is found in the
https://github.com/clearlinux/mixer-tools repo.

Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>
This commit is contained in:
Patrick McCarty
2016-11-30 12:54:10 -08:00
committed by tmarcu
parent b417fc4391
commit 13189dd4d4
8 changed files with 6 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.am
-3
View File
@@ -26,7 +26,6 @@ swupd_create_update_SOURCES = \
src/manifest.c \
src/pack.c \
src/rename.c \
src/signature.c \
src/stats.c \
src/type_change.c \
src/versions.c \
@@ -44,7 +43,6 @@ swupd_make_pack_SOURCES = \
src/manifest.c \
src/pack.c \
src/rename.c \
src/signature.c \
src/stats.c \
src/xattrs.c
@@ -61,7 +59,6 @@ swupd_make_fullfiles_SOURCES = \
src/manifest.c \
src/pack.c \
src/rename.c \
src/signature.c \
src/stats.c \
src/xattrs.c
include/swupd.h
-5
View File
@@ -143,7 +143,6 @@ extern int current_version;
extern int newversion;
extern int minversion;
extern unsigned long long int format;
extern bool enable_signing;
extern char *state_dir;
extern char *packstage_dir;
@@ -259,8 +258,4 @@ extern int system_argv_fd(char *const argv[], int newstdin, int newstdout, int n
extern int system_argv_pipe(char *const argvp1[], int stdinp1, int stderrp1,
char *const argvp2[], int stdoutp2, int stderrp2);
extern bool signature_initialize(void);
extern void signature_terminate(void);
extern bool signature_sign(const char *filename);
#endif
src/create_update.c
+1 -13
View File
@@ -54,7 +54,6 @@ static const struct option prog_opts[] = {
{ "format", required_argument, 0, 'F' },
{ "getformat", no_argument, 0, 'g' },
{ "statedir", required_argument, 0, 'S' },
{ "signcontent", no_argument, 0, 's' },
{ 0, 0, 0, 0 }
};
@@ -72,7 +71,6 @@ static void print_help(const char *name)
printf(" -F, --format Format number for the update\n");
printf(" -g, --getformat Print current format string and exit\n");
printf(" -S, --statedir Optional directory to use for state [ default:=%s ]\n", SWUPD_SERVER_STATE_DIR);
printf(" -s, --signcontent Enables cryptographic signing of update content\n");
printf("\n");
}
@@ -80,7 +78,7 @@ static bool parse_options(int argc, char **argv)
{
int opt;
while ((opt = getopt_long(argc, argv, "hvo:m:F:g:S:s", prog_opts, NULL)) != -1) {
while ((opt = getopt_long(argc, argv, "hvo:m:F:g:S:", prog_opts, NULL)) != -1) {
switch (opt) {
case '?':
case 'h':
@@ -124,9 +122,6 @@ static bool parse_options(int argc, char **argv)
free_globals();
}
exit(0);
case 's':
enable_signing = true;
break;
}
}
@@ -272,12 +267,6 @@ int main(int argc, char **argv)
goto exit;
}
/* Initilize the crypto signature module */
if (!signature_initialize()) {
printf("Can't initialize the crypto signature module!\n");
goto exit;
}
string_or_die(&file_path, "%s/server.ini", state_dir);
if (!read_configuration_file(file_path)) {
printf("Failed to read %s configuration file!\n", state_dir);
@@ -530,7 +519,6 @@ exit:
}
release_configuration_data();
release_group_file();
signature_terminate();
g_list_free(manifests_last_versions_list);
close_log(newversion, exit_status);
src/globals.c
-1
View File
@@ -34,7 +34,6 @@
int newversion = -1;
int minversion = 0;
unsigned long long int format = 0;
bool enable_signing = false;
char *state_dir = NULL;
char *packstage_dir = NULL;
src/make_packs.c
-13
View File
@@ -46,7 +46,6 @@ static void banner(void)
static const struct option prog_opts[] = {
{ "help", no_argument, 0, 'h' },
{ "statedir", required_argument, 0, 'S' },
{ "signcontent", no_argument, 0, 's' },
{ 0, 0, 0, 0 }
};
@@ -57,7 +56,6 @@ static void usage(const char *name)
printf("Help options:\n");
printf(" -h, --help Show help options\n");
printf(" -S, --statedir Optional directory to use for state [ default:=%s ]\n", SWUPD_SERVER_STATE_DIR);
printf(" -s, --signcontent Enables cryptographic signing of update content\n");
printf("\n");
}
@@ -77,9 +75,6 @@ static bool parse_options(int argc, char **argv)
return false;
}
break;
case 's':
enable_signing = true;
break;
}
}
@@ -114,12 +109,6 @@ int main(int argc, char **argv)
banner();
check_root();
/* Initilize the crypto signature module */
if (!signature_initialize()) {
printf("Can't initialize the crypto signature module!\n");
return exit_status;
}
string_or_die(&file_path, "%s/server.ini", state_dir);
read_configuration_file(file_path);
free(file_path);
@@ -152,8 +141,6 @@ int main(int argc, char **argv)
exit_status = EXIT_SUCCESS;
}
signature_terminate();
printf("Pack creation %s (pack-%s %i to %li)\n",
exit_status == EXIT_SUCCESS ? "complete" : "failed",
module, start_version, end_version);
src/manifest.c
+5 -42
View File
@@ -695,29 +695,6 @@ static void compute_content_size(struct manifest *manifest)
}
}
/* Returns 0 == success, -1 == failure */
static int write_manifest_signature(struct manifest *manifest, const char *suffix)
{
char *conf = config_output_dir();
char *filename = NULL;
int ret = -1;
if (conf == NULL) {
assert(0);
}
string_or_die(&filename, "%s/%i/Manifest.%s%s", conf, manifest->version,
manifest->component, suffix);
if (!signature_sign(filename)) {
fprintf(stderr, "Creating signature for '%s' failed\n", filename);
goto exit;
}
ret = 0;
exit:
free(filename);
free(conf);
return ret;
}
/* Returns 0 == success, -1 == failure */
static int write_manifest_plain(struct manifest *manifest)
{
@@ -851,7 +828,7 @@ exit:
static int write_manifest_tar(struct manifest *manifest)
{
char *conf = config_output_dir();
char *directory, *manifesttar, *manifestcomp, *manifestsigned;
char *directory, *manifesttar, *manifestcomp;
int ret = 0;
if (conf == NULL) {
@@ -861,19 +838,11 @@ static int write_manifest_tar(struct manifest *manifest)
string_or_die(&directory, "--directory=%s/%i", conf, manifest->version);
string_or_die(&manifesttar, "%s/%i/Manifest.%s.tar", conf, manifest->version, manifest->component);
string_or_die(&manifestcomp, "Manifest.%s", manifest->component);
string_or_die(&manifestsigned, "Manifest.%s.signed", manifest->component);
/* now, tar the thing up for efficient full file download */
/* and put the signature of the plain manifest into the archive, too */
if (enable_signing) {
char *const tarcmd[] = { TAR_COMMAND, directory, TAR_PERM_ATTR_ARGS_STRLIST, "-Jcf",
manifesttar, manifestcomp, manifestsigned, NULL };
ret = system_argv(tarcmd);
} else {
char *const tarcmd[] = { TAR_COMMAND, directory, TAR_PERM_ATTR_ARGS_STRLIST, "-Jcf",
manifesttar, manifestcomp, NULL };
ret = system_argv(tarcmd);
}
char *const tarcmd[] = { TAR_COMMAND, directory, TAR_PERM_ATTR_ARGS_STRLIST, "-Jcf",
manifesttar, manifestcomp, NULL };
ret = system_argv(tarcmd);
if (ret) {
fprintf(stderr, "Creation of Manifest.tar failed\n");
}
@@ -881,7 +850,6 @@ static int write_manifest_tar(struct manifest *manifest)
free(directory);
free(manifesttar);
free(manifestcomp);
free(manifestsigned);
free(conf);
return ret;
}
@@ -911,9 +879,7 @@ bool compute_hash_with_xattrs(const char *filename)
int write_manifest(struct manifest *manifest)
{
if (write_manifest_plain(manifest) == 0 &&
write_manifest_signature(manifest, "") == 0 &&
write_manifest_tar(manifest) == 0 &&
write_manifest_signature(manifest, ".tar") == 0) {
write_manifest_tar(manifest) == 0) {
return 0;
}
return -1;
@@ -1115,9 +1081,6 @@ void create_manifest_delta(int oldversion, int newversion, char *module)
}
LOG(NULL, "Failed to rename", "");
}
if (!signature_sign(outfile)) {
fprintf(stderr, "Creating signature for '%s' failed\n", outfile);
}
} else {
sleep(1); /* we raced. whatever. sleep for a bit to get the other guy to make progress */
}
src/pack.c
-25
View File
@@ -307,24 +307,6 @@ static void make_pack_deltas(GList *files)
g_thread_pool_free(threadpool, FALSE, TRUE);
}
/* Returns 0 == success, -1 == failure */
static int write_pack_signature(struct packdata *pack)
{
char *filename = NULL;
int ret = -1;
string_or_die(&filename, "%s/%i/pack-%s-from-%i.tar",
staging_dir, pack->to, pack->module, pack->from);
if (!signature_sign(filename)) {
fprintf(stderr, "Creating signature for '%s' failed\n", filename);
goto exit;
}
ret = 0;
exit:
free(filename);
return ret;
}
/* Returns 0 == success, other == failure */
static int make_final_pack(struct packdata *pack)
{
@@ -507,13 +489,6 @@ static int make_final_pack(struct packdata *pack)
if ((ret != 0) && (ret != 1)) {
fprintf(stderr, "Unexpected return value (%d) creating tar of pack %s from %i to %i\n",
ret, pack->module, pack->from, pack->to);
} else {
/* Write the signature file */
ret = write_pack_signature(pack);
if (ret != 0) {
fprintf(stderr, "Failure creating signature of pack %s from %i to %i\n",
pack->module, pack->from, pack->to);
}
}
/* and clean up */
src/signature.c
-173
View File
@@ -1,173 +0,0 @@
/*
* Software Updater - server side
*
* Copyright © 2012-2016 Intel Corporation.
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, version 2 or later of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Authors:
* Tom Keel <thomas.keel@intel.com>
*
*/
#define _GNU_SOURCE
#include <err.h>
#include <errno.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include "swupd.h"
static char *make_filename(const char *, const char *, const char *);
static char *leaf_key = NULL;
static char *leaf_cert = NULL;
static char *ca_chain_cert = NULL;
static char *passphrase = NULL;
static bool initialized = false;
/*
* Initialize this module.
* @return true <=> success
*/
bool signature_initialize(void)
{
if (!enable_signing) {
return true;
}
char *cdir;
char *pphr;
struct stat s;
if (initialized) {
return true;
}
cdir = getenv("SWUPD_CERTS_DIR");
if (cdir == NULL || cdir[0] == '\0') {
printf("No certificates directory specified\n");
goto err;
}
if (stat(cdir, &s)) {
printf("Can't stat certificates directory '%s' (%s)\n", cdir,
strerror(errno));
goto err;
}
leaf_key = make_filename(cdir, "LEAF_KEY", "leaf key");
if (leaf_key == NULL) {
goto err;
}
leaf_cert = make_filename(cdir, "LEAF_CERT", "leaf certificate");
if (leaf_cert == NULL) {
goto err;
}
ca_chain_cert = make_filename(cdir, "CA_CHAIN_CERT", "CA chain certificate");
if (ca_chain_cert == NULL) {
goto err;
}
pphr = getenv("PASSPHRASE");
if (pphr == NULL || (passphrase = strdup(pphr)) == NULL) {
goto err;
}
if (stat(passphrase, &s)) {
printf("Can't stat '%s' (%s)\n", passphrase,
strerror(errno));
goto err;
}
initialized = true;
return true;
err:
signature_terminate();
return false;
}
/* Make filename from dir name and env variable containing basename */
static char *make_filename(const char *dir, const char *env, const char *desc)
{
char *fn = getenv(env);
char *result = NULL;
struct stat s;
if (fn == NULL || fn[0] == '\0') {
printf("No %s file specified\n", desc);
return NULL;
}
string_or_die(&result, "%s/%s", dir, fn);
if (stat(result, &s)) {
printf("Can't stat %s '%s' (%s)\n", desc, result, strerror(errno));
free(result);
return NULL;
}
return result;
}
/*
* Terminate this module, free resources.
*/
void signature_terminate(void)
{
if (!enable_signing) {
return;
}
free(leaf_key);
free(leaf_cert);
free(ca_chain_cert);
free(passphrase);
leaf_key = NULL;
leaf_cert = NULL;
ca_chain_cert = NULL;
passphrase = NULL;
initialized = false;
}
/*
* Write the signature file corresponding to the given data file.
* The name of the signature file is the name of the data file with suffix
* ".signed" appended.
*/
bool signature_sign(const char *filename)
{
char *param1, *param2;
int status;
if (!enable_signing) {
return true;
}
if (!initialized) {
return false;
}
string_or_die(&param1, "%s.signed", filename);
string_or_die(&param2, "file:%s", passphrase);
char *const opensslcmd[] = { "openssl", "smime", "-sign", "-in", (char *)filename, "-binary",
"-out", param1, "-outform", " PEM", "-md", "sha256", "-inkey",
leaf_key, "-signer", leaf_cert, "-certfile", ca_chain_cert,
"-passin", param2, NULL };
status = system_argv(opensslcmd);
if (status != 0) {
printf("Bad status %d from signing command\n", status);
}
free(param1);
free(param2);
return status == 0;
}