richardphibel / rpms / dnf

Forked from rpms/dnf 2 years ago
Clone

Blame SOURCES/0005-Lower-_pkgverify_level-to-signature-for-signature-ch.patch

52b19a
From 185330e5d5f5e07f40ed08c706fd997abffd5e78 Mon Sep 17 00:00:00 2001
52b19a
From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= <amatej@redhat.com>
0d2313
Date: Thu, 3 Jun 2021 11:23:31 +0200
52b19a
Subject: [PATCH] Lower _pkgverify_level to signature for signature checking
52b19a
 with rpmkeys
0d2313
0d2313
We don't want to be veryfing digests as well when checking signatures.
0d2313
It would break legacy package installation in FIPS mode due to MD5
0d2313
digest being unverifiable (see https://access.redhat.com/solutions/5221661)
0d2313
0d2313
Follow up for https://github.com/rpm-software-management/dnf/pull/1753
0d2313
---
0d2313
 dnf/rpm/miscutils.py | 7 +++----
0d2313
 1 file changed, 3 insertions(+), 4 deletions(-)
0d2313
0d2313
diff --git a/dnf/rpm/miscutils.py b/dnf/rpm/miscutils.py
52b19a
index 9d5b2860..46ef4754 100644
0d2313
--- a/dnf/rpm/miscutils.py
0d2313
+++ b/dnf/rpm/miscutils.py
0d2313
@@ -66,11 +66,10 @@ def _verifyPackageUsingRpmkeys(package, installroot):
0d2313
         _logger.critical(_('Cannot find rpmkeys executable to verify signatures.'))
0d2313
         return 2
0d2313
 
0d2313
-    # "--define=_pkgverify_level all" enforces signature checking;
0d2313
-    # "--define=_pkgverify_flags 0x0" ensures that all signatures and digests
0d2313
-    # are checked.
0d2313
+    # "--define=_pkgverify_level signature" enforces signature checking;
0d2313
+    # "--define=_pkgverify_flags 0x0" ensures that all signatures are checked.
0d2313
     args = ('rpmkeys', '--checksig', '--root', installroot, '--verbose',
0d2313
-            '--define=_pkgverify_level all', '--define=_pkgverify_flags 0x0',
0d2313
+            '--define=_pkgverify_level signature', '--define=_pkgverify_flags 0x0',
0d2313
             '-')
0d2313
     with subprocess.Popen(
0d2313
             args=args,
52b19a
-- 
52b19a
2.35.1
0d2313