1abbee
From 1b7d1234cd22bb0fd2677d54dc670a6d2c6f8089 Mon Sep 17 00:00:00 2001
1abbee
From: Lennart Poettering <lennart@poettering.net>
1abbee
Date: Mon, 2 Mar 2015 20:24:11 +0100
1abbee
Subject: [PATCH] import: add support for gpg2 for verifying imported images
1abbee
1abbee
gpg2 insists on created a trust db even if we tun off all trust db
1abbee
support. Hence create a temporary home where the trust db is placed, and
1abbee
remove it after use.
1abbee
1abbee
Cherry-picked from: 0acfdffe9417b4218e97b6d981c99a1a85e633c9
1abbee
Resolves: #1284974
1abbee
---
1abbee
 src/import/import-common.c | 21 ++++++++++++++++++---
1abbee
 1 file changed, 18 insertions(+), 3 deletions(-)
1abbee
1abbee
diff --git a/src/import/import-common.c b/src/import/import-common.c
181b3f
index 2acf380f9..f10a453ee 100644
1abbee
--- a/src/import/import-common.c
1abbee
+++ b/src/import/import-common.c
1abbee
@@ -281,8 +281,9 @@ int import_verify(
1abbee
         _cleanup_free_ char *fn = NULL;
1abbee
         _cleanup_close_ int sig_file = -1;
1abbee
         const char *p, *line;
1abbee
-        char sig_file_path[] = "/tmp/sigXXXXXX";
1abbee
+        char sig_file_path[] = "/tmp/sigXXXXXX", gpg_home[] = "/tmp/gpghomeXXXXXX";
1abbee
         _cleanup_sigkill_wait_ pid_t pid = 0;
1abbee
+        bool gpg_home_created = false;
1abbee
         int r;
1abbee
 
1abbee
         assert(main_job);
1abbee
@@ -347,6 +348,13 @@ int import_verify(
1abbee
                 goto finish;
1abbee
         }
1abbee
 
1abbee
+        if (!mkdtemp(gpg_home)) {
1abbee
+                r = log_error_errno(errno, "Failed to create tempory home for gpg: %m");
1abbee
+                goto finish;
1abbee
+        }
1abbee
+
1abbee
+        gpg_home_created = true;
1abbee
+
1abbee
         pid = fork();
1abbee
         if (pid < 0)
1abbee
                 return log_error_errno(errno, "Failed to fork off gpg: %m");
1abbee
@@ -359,13 +367,14 @@ int import_verify(
1abbee
                         "--no-auto-check-trustdb",
1abbee
                         "--batch",
1abbee
                         "--trust-model=always",
1abbee
-                        NULL, /* keyring to use */
1abbee
+                        NULL, /* --homedir=  */
1abbee
+                        NULL, /* --keyring= */
1abbee
                         NULL, /* --verify */
1abbee
                         NULL, /* signature file */
1abbee
                         NULL, /* dash */
1abbee
                         NULL  /* trailing NULL */
1abbee
                 };
1abbee
-                unsigned k = ELEMENTSOF(cmd) - 5;
1abbee
+                unsigned k = ELEMENTSOF(cmd) - 6;
1abbee
                 int null_fd;
1abbee
 
1abbee
                 /* Child */
1abbee
@@ -398,6 +407,8 @@ int import_verify(
1abbee
                 if (null_fd != STDOUT_FILENO)
1abbee
                         null_fd = safe_close(null_fd);
1abbee
 
1abbee
+                cmd[k++] = strjoina("--homedir=", gpg_home);
1abbee
+
1abbee
                 /* We add the user keyring only to the command line
1abbee
                  * arguments, if it's around since gpg fails
1abbee
                  * otherwise. */
1abbee
@@ -415,6 +426,7 @@ int import_verify(
1abbee
                 fd_cloexec(STDOUT_FILENO, false);
1abbee
                 fd_cloexec(STDERR_FILENO, false);
1abbee
 
1abbee
+                execvp("gpg2", (char * const *) cmd);
1abbee
                 execvp("gpg", (char * const *) cmd);
1abbee
                 log_error_errno(errno, "Failed to execute gpg: %m");
1abbee
                 _exit(EXIT_FAILURE);
1abbee
@@ -446,6 +458,9 @@ finish:
1abbee
         if (sig_file >= 0)
1abbee
                 unlink(sig_file_path);
1abbee
 
1abbee
+        if (gpg_home_created)
1abbee
+                rm_rf_dangerous(gpg_home, false, true, false);
1abbee
+
1abbee
         return r;
1abbee
 }
1abbee