From a4f21266a6dab9e77913d56c04aba1e579f0e0c1 Mon Sep 17 00:00:00 2001
From: Marek Blaha <mblaha@redhat.com>
Date: Fri, 23 Oct 2020 09:06:35 +0200
Subject: [PATCH 1/2] [reposync] Reorder options alphabetically
---
doc/reposync.rst | 30 +++++++++++++++---------------
plugins/reposync.py | 18 +++++++++---------
2 files changed, 24 insertions(+), 24 deletions(-)
diff --git a/doc/reposync.rst b/doc/reposync.rst
index 71a435dc..3b820f33 100644
--- a/doc/reposync.rst
+++ b/doc/reposync.rst
@@ -39,36 +39,36 @@ Options
All general DNF options are accepted. Namely, the ``--repoid`` option can be used to specify the repositories to synchronize. See `Options` in :manpage:`dnf(8)` for details.
-``-p <download-path>, --download-path=<download-path>``
- Root path under which the downloaded repositories are stored, relative to the current working directory. Defaults to the current working directory. Every downloaded repository has a subdirectory named after its ID under this path.
-
-``--norepopath``
- Don't add the reponame to the download path. Can only be used when syncing a single repository (default is to add the reponame).
-
-``--download-metadata``
- Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
-
``-a <architecture>, --arch=<architecture>``
Download only packages of given architectures (default is all architectures). Can be used multiple times.
-``--source``
- Operate on source packages.
+``--delete``
+ Delete local packages no longer present in repository.
+
+``--download-metadata``
+ Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
``-m, --downloadcomps``
Also download and uncompress comps.xml. Consider using ``--download-metadata`` option which will download all available repository metadata.
+``--metadata-path``
+ Root path under which the downloaded metadata are stored. It defaults to ``--download-path`` value if not given.
+
``-n, --newest-only``
Download only newest packages per-repo.
-``--delete``
- Delete local packages no longer present in repository.
+``--norepopath``
+ Don't add the reponame to the download path. Can only be used when syncing a single repository (default is to add the reponame).
-``--metadata-path``
- Root path under which the downloaded metadata are stored. It defaults to ``--download-path`` value if not given.
+``-p <download-path>, --download-path=<download-path>``
+ Root path under which the downloaded repositories are stored, relative to the current working directory. Defaults to the current working directory. Every downloaded repository has a subdirectory named after its ID under this path.
``--remote-time``
Try to set the timestamps of the downloaded files to those on the remote side.
+``--source``
+ Operate on source packages.
+
``-u, --urls``
Just print urls of what would be downloaded, don't download.
diff --git a/plugins/reposync.py b/plugins/reposync.py
index 7556e7eb..6f572cac 100644
--- a/plugins/reposync.py
+++ b/plugins/reposync.py
@@ -63,24 +63,24 @@ def set_argparser(parser):
help=_('download only packages for this ARCH'))
parser.add_argument('--delete', default=False, action='store_true',
help=_('delete local packages no longer present in repository'))
- parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
- help=_('also download and uncompress comps.xml'))
parser.add_argument('--download-metadata', default=False, action='store_true',
help=_('download all the metadata.'))
+ parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
+ help=_('also download and uncompress comps.xml'))
+ parser.add_argument('--metadata-path',
+ help=_('where to store downloaded repository metadata. '
+ 'Defaults to the value of --download-path.'))
parser.add_argument('-n', '--newest-only', default=False, action='store_true',
help=_('download only newest packages per-repo'))
- parser.add_argument('-p', '--download-path', default='./',
- help=_('where to store downloaded repositories'))
parser.add_argument('--norepopath', default=False, action='store_true',
help=_("Don't add the reponame to the download path."))
- parser.add_argument('--metadata-path',
- help=_('where to store downloaded repository metadata. '
- 'Defaults to the value of --download-path.'))
- parser.add_argument('--source', default=False, action='store_true',
- help=_('operate on source packages'))
+ parser.add_argument('-p', '--download-path', default='./',
+ help=_('where to store downloaded repositories'))
parser.add_argument('--remote-time', default=False, action='store_true',
help=_('try to set local timestamps of local files by '
'the one on the server'))
+ parser.add_argument('--source', default=False, action='store_true',
+ help=_('operate on source packages'))
parser.add_argument('-u', '--urls', default=False, action='store_true',
help=_("Just list urls of what would be downloaded, "
"don't download"))
From 978b7f2b1c654fed7b1b4cf45cb607143226804c Mon Sep 17 00:00:00 2001
From: Marek Blaha <mblaha@redhat.com>
Date: Fri, 23 Oct 2020 09:14:02 +0200
Subject: [PATCH 2/2] [reposync] Check GPG signatures of downloaded packages
(RhBug:1856818)
YUMv3 reposync used to have --gpgcheck option to remove packages that fail GPG
signature checking after downloading.
This patch implements the option for DNF.
= changelog =
msg: Add --gpgcheck option to reposync (RhBug:1856818)
type: enhancement
resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1856818
---
doc/reposync.rst | 4 ++++
plugins/reposync.py | 21 +++++++++++++++++++++
2 files changed, 25 insertions(+)
diff --git a/doc/reposync.rst b/doc/reposync.rst
index 3b820f33..de40957f 100644
--- a/doc/reposync.rst
+++ b/doc/reposync.rst
@@ -48,6 +48,10 @@ All general DNF options are accepted. Namely, the ``--repoid`` option can be use
``--download-metadata``
Download all repository metadata. Downloaded copy is instantly usable as a repository, no need to run createrepo_c on it.
+``-g, --gpgcheck``
+ Remove packages that fail GPG signature checking after downloading. Exit code is ``1`` if at least one package was removed.
+ Note that for repositories with ``gpgcheck=0`` set in their configuration the GPG signature is not checked even with this option used.
+
``-m, --downloadcomps``
Also download and uncompress comps.xml. Consider using ``--download-metadata`` option which will download all available repository metadata.
diff --git a/plugins/reposync.py b/plugins/reposync.py
index 6f572cac..c891bfa2 100644
--- a/plugins/reposync.py
+++ b/plugins/reposync.py
@@ -24,6 +24,7 @@
import hawkey
import os
import shutil
+import types
from dnfpluginscore import _, logger
from dnf.cli.option_parser import OptionParser
@@ -65,6 +66,9 @@ def set_argparser(parser):
help=_('delete local packages no longer present in repository'))
parser.add_argument('--download-metadata', default=False, action='store_true',
help=_('download all the metadata.'))
+ parser.add_argument('-g', '--gpgcheck', default=False, action='store_true',
+ help=_('Remove packages that fail GPG signature checking '
+ 'after downloading'))
parser.add_argument('-m', '--downloadcomps', default=False, action='store_true',
help=_('also download and uncompress comps.xml'))
parser.add_argument('--metadata-path',
@@ -114,6 +118,7 @@ def configure(self):
def run(self):
self.base.conf.keepcache = True
+ gpgcheck_ok = True
for repo in self.base.repos.iter_enabled():
if self.opts.remote_time:
repo._repo.setPreserveRemoteTime(True)
@@ -150,8 +155,24 @@ def run(self):
self.print_urls(pkglist)
else:
self.download_packages(pkglist)
+ if self.opts.gpgcheck:
+ for pkg in pkglist:
+ local_path = self.pkg_download_path(pkg)
+ # base.package_signature_check uses pkg.localPkg() to determine
+ # the location of the package rpm file on the disk.
+ # Set it to the correct download path.
+ pkg.localPkg = types.MethodType(
+ lambda s, local_path=local_path: local_path, pkg)
+ result, error = self.base.package_signature_check(pkg)
+ if result != 0:
+ logger.warning(_("Removing {}: {}").format(
+ os.path.basename(local_path), error))
+ os.unlink(local_path)
+ gpgcheck_ok = False
if self.opts.delete:
self.delete_old_local_packages(repo, pkglist)
+ if not gpgcheck_ok:
+ raise dnf.exceptions.Error(_("GPG signature check failed."))
def repo_target(self, repo):
return _pkgdir(self.opts.destdir or self.opts.download_path,