31#include <zypp-core/fs/WatchFile>
42#undef ZYPP_BASE_LOGGER_LOGGROUP
43#define ZYPP_BASE_LOGGER_LOGGROUP "zypp::KeyRing"
57 {
return _keyRingDefaultAccept; }
61 MIL <<
"Set new KeyRing::DefaultAccept: " << value_r << endl;
62 _keyRingDefaultAccept = value_r;
90 data.
set(
"PublicKey", key_r);
91 data.
set(
"KeyContext", keycontext_r);
95 return data.
get<
bool>(
"TrustKey");
102 data.
set(
"Keys", keys_r);
111 data.set(
"KeyDataList", keyDataList_r );
112 data.set(
"KeySigning", keySigning_r );
113 data.set(
"KeyContext", keyContext_r );
160 {
return getData( keyring_r ); }
172 return getData( keyring_r, cache );
179 MIL <<
"Found keys: " << cache_r.
_data << std::endl;
181 return cache_r.
_data;
190 struct ImportKeyCBHelper
195 _rpmdbEmitSignal->trustedKeyAdded( key_r );
196 _emitSignal->trustedKeyAdded( key_r );
198 catch (
const Exception & excp )
200 ERR <<
"Could not import key into rpmdb: " << excp << endl;
202 JobReport::error( excp.asUserHistory() );
207 callback::SendReport<target::rpm::KeyRingSignals> _rpmdbEmitSignal;
208 callback::SendReport<KeyRingSignals> _emitSignal;
217 MIL <<
"Current KeyRing::DefaultAccept: " << _keyRingDefaultAccept << std::endl;
223 MIL <<
"Imported key " << key <<
" to " << (trusted ?
"trustedKeyRing" :
"generalKeyRing" ) << endl;
227 ImportKeyCBHelper emitSignal;
250 if ( ! keyDataToDel )
252 WAR <<
"Key to delete [" <<
id <<
"] is not in " << (trusted ?
"trustedKeyRing" :
"generalKeyRing" ) << endl;
256 MIL <<
"Deleted key [" <<
id <<
"] from " << (trusted ?
"trustedKeyRing" :
"generalKeyRing" ) << endl;
263 rpmdbEmitSignal->trustedKeyRemoved( key );
266 emitSignal->trustedKeyRemoved( key );
270 ERR <<
"Could not delete key from rpmmdb: " << excp << endl;
286 if ( key.providesKey(
id ) )
292 DBG << (ret ?
"Found" :
"No") <<
" key [" <<
id <<
"] in keyring " <<
keyring << endl;
298 MIL <<
"preloadCachedKeys into general keyring..." << endl;
304 std::set<Pathname> cachedirs;
306 cachedirs.insert( conf.pubkeyCachePath() );
307 cachedirs.insert(
"/usr/lib/rpm/gnupg/keys" );
308 if (
Pathname r = conf.systemRoot(); r !=
"/" && not r.
empty() ) {
309 cachedirs.insert( r / conf.pubkeyCachePath() );
310 cachedirs.insert( r /
"/usr/lib/rpm/gnupg/keys" );
312 if (
Pathname r = conf.repoManagerRoot(); r !=
"/" && not r.
empty() ) {
313 cachedirs.insert( r / conf.pubkeyCachePath() );
314 cachedirs.insert( r /
"/usr/lib/rpm/gnupg/keys" );
317 std::map<std::string,Pathname> keyCandidates;
318 const str::regex rx {
"^gpg-pubkey-([[:xdigit:]]{8,})(-[[:xdigit:]]{8,})?\\.(asc|key)$" };
319 for (
const auto & cache : cachedirs ) {
321 [&rx,&keyCandidates](
const Pathname & dir_r,
const char *
const file_r )->
bool {
324 Pathname & remember { keyCandidates[what[1]] };
325 if ( remember.empty() ) {
326 remember = dir_r / file_r;
334 for (
const auto & p : keyCandidates ) {
337 const std::string &
id { p.first };
341 if ( manip.keyManagerCtx().importKey( path ) ) {
342 DBG <<
"preload key file " << path << endl;
345 WAR <<
"Skipping: Can't preload key file " << path << endl;
362 WAR <<
"No key [" <<
id <<
"] to export from " <<
keyring << endl;
375 MIL <<
"Going to export key [" <<
id <<
"] from " <<
keyring <<
" to " << tmpFile.
path() << endl;
377 std::ofstream os( tmpFile.
path().
c_str() );
386 std::list<PublicKey> ret;
388 for_( it, keys.begin(), keys.end() )
391 ret.push_back( key );
392 MIL <<
"Found key " << key << endl;
399 if ( !
PathInfo( keyfile ).isExist() )
406 if ( ! manip.keyManagerCtx().importKey( keyfile ) )
413 if ( ! manip.keyManagerCtx().deleteKey(
id ) )
419 if ( !
PathInfo( signature ).isFile() )
422 MIL <<
"Determining key id of signature " << signature << endl;
425 if ( ! fprs.empty() ) {
426 std::string &
id = fprs.back();
427 MIL <<
"Determined key id [" <<
id <<
"] for signature " << signature << endl;
430 return std::string();
459 {
_pimpl->allowPreload( yesno_r ); }
463 {
_pimpl->importKey( key, trusted ); }
466 {
_pimpl->multiKeyImport( keyfile_r, trusted_r ); }
469 {
return _pimpl->readSignatureKeyId( signature ); }
472 {
_pimpl->deleteKey(
id, trusted ); }
475 {
return _pimpl->publicKeys(); }
478 {
return _pimpl->trustedPublicKeys(); }
481 {
return _pimpl->publicKeyData(); }
484 {
return _pimpl->trustedPublicKeyData(); }
487 {
return _pimpl->publicKeyExists( id_r ); }
490 {
return _pimpl->trustedPublicKeyExists( id_r ); }
493 {
return _pimpl->verifyFileSignature( file, signature ); }
496 {
return _pimpl->verifyFileTrustedSignature( file, signature ); }
498 {
_pimpl->dumpPublicKey(
id, trusted, stream ); }
501 {
return _pimpl->exportPublicKey( keyData ); }
504 {
return _pimpl->exportTrustedPublicKey( keyData ); }
507 {
return _pimpl->isKeyTrusted(
id ); }
510 {
return _pimpl->isKeyKnown(
id ); }
bool operator()(const zypp::Arch &lhs, const zypp::Arch &rhs) const
Default order for std::container based Arch::compare.
Base class for Exception.
std::string asUserHistory() const
A single (multiline) string composed of asUserString and historyAsString.
bool exportKey(const std::string &id, std::ostream &stream)
Exports the key with id into the given stream, returns true on success.
std::list< PublicKeyData > listKeys()
Returns a list of all public keys found in the current keyring.
bool verify(const Pathname &file, const Pathname &signature)
Tries to verify file using signature, returns true on success.
static KeyManagerCtx createForOpenPGP()
Creates a new KeyManagerCtx for PGP using a volatile temp.
std::list< std::string > readSignatureFingerprints(const Pathname &signature)
Reads all fingerprints from the signature file , returns a list of all found fingerprints.
KeyRing::Impl & pimpl()
Access to private functions for the KeyRingWorkflow implementations.
bool verifyFileTrustedSignature(const Pathname &file, const Pathname &signature) ZYPP_API
bool isKeyKnown(const std::string &id)
true if the key id is knows, that means at least exist on the untrusted keyring
std::list< PublicKey > publicKeys()
Get a list of public keys in the keyring (incl.
std::list< PublicKey > trustedPublicKeys()
Get a list of trusted public keys in the keyring (incl.
static DefaultAccept defaultAccept()
Get the active accept bits.
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
Initial import from RpmDb.
KeyRing(const Pathname &baseTmpDir)
Default ctor.
PublicKey exportPublicKey(const PublicKeyData &keyData)
Export a public key identified by its key data.
std::string readSignatureKeyId(const Pathname &signature)
reads the public key id from a signature
void allowPreload(bool yesno_r)
The general keyring may be populated with known keys stored on the system.
void importKey(const PublicKey &key, bool trusted=false)
imports a key from a file.
RW_pointer< Impl > _pimpl
Pointer to implementation.
bool verifyFileSignature(const Pathname &file, const Pathname &signature) ZYPP_API
Verifies a file against a signature, with no user interaction.
void deleteKey(const std::string &id, bool trusted=false)
removes a key from the keyring.
std::list< PublicKeyData > trustedPublicKeyData()
Get a list of trusted public key data in the keyring (key data only)
static void setDefaultAccept(DefaultAccept value_r)
Set the active accept bits.
std::list< PublicKeyData > publicKeyData()
Get a list of public key data in the keyring (key data only)
@ ACCEPT_VERIFICATION_FAILED
PublicKey exportTrustedPublicKey(const PublicKeyData &keyData)
Export a trusted public key identified by its key data.
bool isKeyTrusted(const std::string &id)
true if the key id is trusted
Class representing one GPG Public Keys data.
std::string id() const
Key ID.
Class representing one GPG Public Key (PublicKeyData + ASCII armored in a tempfile).
Pathname path() const
File containing the ASCII armored key.
const std::list< PublicKeyData > & hiddenKeys() const
Additional keys data in case the ASCII armored blob contains multiple keys.
Remember a files attributes to detect content changes.
Interim helper class to collect global options and settings.
static ZConfig & instance()
Singleton ctor.
const Tp & get(const std::string &key_r) const
Pass back a const Tp & reference to key_r value.
bool hasvalue(const std::string &key_r) const
Whether key_r is in data and value is not empty.
bool set(const std::string &key_r, AnyType val_r)
Set the value for key (nonconst version always returns true).
Wrapper class for stat/lstat.
const char * c_str() const
String representation.
const std::string & asString() const
String representation.
bool empty() const
Test for an empty path.
Provide a new empty temporary file and delete it when no longer needed.
Regular expression match result.
bool regex_match(const std::string &s, smatch &matches, const regex ®ex)
\relates regex \ingroup ZYPP_STR_REGEX \relates regex \ingroup ZYPP_STR_REGEX
Easy-to use interface to the ZYPP dependency resolver.
scoped_ptr< WatchFile > _keyringP
void assertCache(const Pathname &keyring_r)
std::list< PublicKeyData > _data
scoped_ptr< WatchFile > _keyringK
Helper providing on demand a KeyManagerCtx to manip the cached keyring.
std::optional< KeyManagerCtx > _context
KeyManagerCtx & keyManagerCtx()
Manip(CachedPublicKeyData &cache_r, Pathname keyring_r)
CachedPublicKeyData & _cache
Functor returning the keyrings data (cached).
void setDirty(const Pathname &keyring_r)
const std::list< PublicKeyData > & operator()(const Pathname &keyring_r) const
const std::list< PublicKeyData > & getData(const Pathname &keyring_r) const
Manip manip(Pathname keyring_r)
Helper providing on demand a KeyManagerCtx to manip the cached keyring.
static bool error(const std::string &msg_r, const UserData &userData_r=UserData())
send error text
virtual void infoVerify(const std::string &file_r, const PublicKeyData &keyData_r, const KeyContext &keycontext=KeyContext())
Informal callback showing the trusted key that will be used for verification.
void reportNonImportedKeys(const std::set< Edition > &keys_r)
Notify the user about keys that were not imported from the rpm key database into zypp keyring.
KeyTrust
User reply options for the askUserToTrustKey callback.
@ KEY_TRUST_AND_IMPORT
Import the key.
@ KEY_DONT_TRUST
User has chosen not to trust the key.
@ KEY_TRUST_TEMPORARILY
This basically means, we knew the key, but it was not trusted.
static constexpr const char * REPORT_AUTO_IMPORT_KEY
generic reports UserData::type
virtual bool askUserToAcceptUnsignedFile(const std::string &file, const KeyContext &keycontext=KeyContext())
bool askUserToAcceptPackageKey(const PublicKey &key_r, const KeyContext &keycontext_r=KeyContext())
Ask user to trust and/or import the package key to trusted keyring, using ReportBase::report.
static constexpr const char * ACCEPT_PACKAGE_KEY_REQUEST
generic reports UserData::type
static constexpr const char * KEYS_NOT_IMPORTED_REPORT
generic reports UserData::type
void reportAutoImportKey(const std::list< PublicKeyData > &keyDataList_r, const PublicKeyData &keySigning_r, const KeyContext &keyContext_r)
Notify that a repository auto imported new package signing keys.
virtual KeyTrust askUserToAcceptKey(const PublicKey &key, const KeyContext &keycontext=KeyContext())
Ask user to trust and/or import the key to trusted keyring.
virtual bool askUserToAcceptUnknownKey(const std::string &file, const std::string &id, const KeyContext &keycontext=KeyContext())
we DONT know the key, only its id, but we have never seen it, the difference with trust key is that i...
virtual bool askUserToAcceptVerificationFailed(const std::string &file, const PublicKey &key, const KeyContext &keycontext=KeyContext())
The file filedesc is signed but the verification failed.
void importKey(const PublicKey &key, bool trusted=false)
void preloadCachedKeys()
Load key files cached on the system into the generalKeyRing.
CachedPublicKeyData::Manip keyRingManip(const Pathname &keyring)
Impl helper providing on demand a KeyManagerCtx to manip a cached keyring.
PublicKeyData publicKeyExists(const std::string &id)
PublicKey exportKey(const std::string &id, const Pathname &keyring)
Impl(const Pathname &baseTmpDir)
bool verifyFile(const Pathname &file, const Pathname &signature, const Pathname &keyring)
const Pathname generalKeyRing() const
filesystem::TmpDir _general_tmp_dir
std::string readSignatureKeyId(const Pathname &signature)
void multiKeyImport(const Pathname &keyfile_r, bool trusted_r=false)
std::list< PublicKey > publicKeys()
void deleteKey(const std::string &id, bool trusted)
const Pathname trustedKeyRing() const
filesystem::TmpFile dumpPublicKeyToTmp(const std::string &id, const Pathname &keyring)
filesystem::TmpDir _trusted_tmp_dir
void dumpPublicKey(const std::string &id, bool trusted, std::ostream &stream)
virtual void report(const UserData &userData_r=UserData())
The most generic way of sending/receiving data.
callback::UserData UserData
#define for_(IT, BEG, END)
Convenient for-loops using iterator.
#define ZYPP_THROW(EXCPT)
Drops a logline and throws the Exception.
#define IMPL_PTR_TYPE(NAME)